PT-2003-2193 · H Sphere · H-Sphere Webshell

Published 2003-12-31 · Updated 2008-09-05 · CVE-2003-1248

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions H-Sphere WebShell version 2.3

Description The issue allows remote attackers to execute arbitrary commands. This can be achieved by using shell metacharacters in the mode and zipfile parameters in a URL request.

Recommendations For H-Sphere WebShell version 2.3, consider restricting access to the vulnerable parameters mode and zipfile to minimize the risk of exploitation. Avoid using shell metacharacters in these parameters until the issue is resolved.

Fix

Related Identifiers

CVE-2003-1248

Affected Products

H-Sphere Webshell

References · 7

• http://securityfocus.com/archive/1/305313 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1248 · Security Note
• http://psoft.net/misc/webshell_patch.html · Patch
• http://securityfocus.com/bid/6539 · Patch
• http://iss.net/security_center/static/11001.php · Patch
• http://securityfocus.com/bid/6537 · Patch
• http://securitytracker.com/id?1005893 · Note