Just had this hit my email, and thought I'd share:


TITLE:
Plesk "PLESKSESSID" SQL Injection Vulnerability

SECUNIA ADVISORY ID:
SA26741

VERIFY ADVISORY:
http://secunia.com/advisories/26741/

CRITICAL:
Moderately critical

IMPACT:
Manipulation of data

WHERE:
>From remote

SOFTWARE:
Plesk 7.x
http://secunia.com/product/3833/
Plesk 8.x
http://secunia.com/product/12876/

DESCRIPTION:
A vulnerability has been reported in Plesk, which can be exploited by
malicious people to conduct SQL injection attacks.

Input passed to the "PLESKSESSID" cookie is not properly sanitised in
auth.php3 before being used in SQL queries. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is reported in Plesk for Windows versions 7.6.1,
8.1.0, 8.1.1, and 8.2.0.

SOLUTION:
Apply the vendor patch.
http://kb.swsoft.com/en/2159

PROVIDED AND/OR DISCOVERED BY:
Nick I Merritt, HackerSafe Labs

ORIGINAL ADVISORY:
http://kb.swsoft.com/en/2159

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Link to linux flavored fix:

http://kb.swsoft.com/en/2169

Plesk 8.2.1 also fixes this.