PT-2007-4828 · Yoggie · Yoggie Pico+1

Published 2007-07-05 · Updated 2017-07-29 · CVE-2007-3572

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yoggie Pico and Pico Pro (affected versions not specified)

Description The issue is related to an incomplete blacklist vulnerability in the cgi-bin/runDiagnostics.cgi file within the web interface. This allows remote attackers to execute arbitrary commands by injecting shell metacharacters in the param parameter. An example of such an attack involves using URL encoded "`" (backtick) characters, represented as %60 sequences.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-3572

Affected Products

Yoggie Pico

Yoggie Pico Pro

References · 9

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0020.html · Exploit
• 🔥 http://securityfocus.com/bid/24743 · Exploit
• 🔥 http://secunia.com/advisories/25902 · Exploit
• 🔥 https://exploit-db.com/exploits/30260 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3572 · Security Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0092.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35208 · Note
• http://osvdb.org/37808 · Note
• http://vupen.com/english/advisories/2007/2417 · Note