PT-2007-7293 · Anon · Anon Proxy Server

Michael Brooks · Publicado 2007-12-20 · Atualizado 2018-10-15 · CVE-2007-6459

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Anon Proxy Server versions 0.100 through 0.101

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter to "diagdns.php" and the host parameter, and possibly the port parameter to "diagconnect.php".

Recommendations For Anon Proxy Server versions 0.100 through 0.101, consider disabling access to the diagdns.php and diagconnect.php scripts until a patch is available. Restrict input for the host and port parameters in these scripts to prevent command execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-6459

Produtos afetados

Anon Proxy Server

Referências · 7

• 🔥 https://exploit-db.com/exploits/4734 · Exploit
• 🔥 http://securityfocus.com/bid/26882 · Exploit
• http://osvdb.org/43711 · Nota
• http://securityfocus.com/archive/1/485151/100/0/threaded · Nota
• http://osvdb.org/43712 · Nota
• http://securityreason.com/securityalert/3463 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6459 · Nota de Segurança