Currently, when certificates will be created, the system checks not the permission of domain (Does the user own the domain?), located at following Lines:

• module.php:225
• module.php:241
• module.php:256
• module.php:273

If a certificate is added manually, the certificate is currently not completely checked for validity:

• module.php:325

Possible behavior

• XSS may allow a certificate to be added to a domain even though the user currently logged in does not own this domain.
• If the certificate is faulty (as it is not currently being intensively checked for validity), the apache2 web server may refuse to provide the service.