PT-2007-4828 · Yoggie · Yoggie Pico+1

Publicado 2007-07-05 · Atualizado 2017-07-29 · CVE-2007-3572

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yoggie Pico and Pico Pro (affected versions not specified)

Description The issue is related to an incomplete blacklist vulnerability in the cgi-bin/runDiagnostics.cgi file within the web interface. This allows remote attackers to execute arbitrary commands by injecting shell metacharacters in the param parameter. An example of such an attack involves using URL encoded "`" (backtick) characters, represented as %60 sequences.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2007-3572

Produtos afetados

Yoggie Pico

Yoggie Pico Pro

Referências · 9

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0020.html · Exploit
• 🔥 http://securityfocus.com/bid/24743 · Exploit
• 🔥 http://secunia.com/advisories/25902 · Exploit
• 🔥 https://exploit-db.com/exploits/30260 · Exploit
• http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0092.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35208 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3572 · Nota de Segurança
• http://osvdb.org/37808 · Nota
• http://vupen.com/english/advisories/2007/2417 · Nota