PT-2013-3102 · Os4Edu · Opensis

Egidio Romano · Publicado 2013-12-09 · Atualizado 2020-09-03 · CVE-2013-1349

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions openSIS versions 4.5 through 5.2

Description The issue allows remote attackers to execute arbitrary PHP code via the modname parameter in the "ajax.php" file.

Recommendations For openSIS versions 4.5 through 5.2, consider restricting access to the modname parameter in the "ajax.php" file until a patch is available.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2013-1349

Produtos afetados

Opensis

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/opensis_modname_exec.rb · Exploit
• 🔥 http://karmainsecurity.com/KIS-2013-10 · Exploit
• 🔥 https://exploit-db.com/exploits/30471 · Exploit
• 🔥 http://sourceforge.net/p/opensis-ce/code/1009 · Exploit
• 🔥 http://sourceforge.net/p/opensis-ce/bugs/59 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1349 · Nota de Segurança
• http://secunia.com/advisories/55913 · Aviso do Fabricante