PT-2011-3636 · Smartertools · Smarterstats

Published 2011-05-20 · Updated 2017-08-29 · CVE-2011-2148

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0

Description The issue allows remote attackers to execute arbitrary commands. This is related to an "OS command injection" issue, where attackers can exploit the vulnerability via specific vectors involving parameters such as STTTState cookie, ctl00$MPH$txtAdminNewPassword SettingText parameter, ctl00$MPH$txtSmarterLogDirectory parameter, ctl00$MPH$ucSiteSeoSearchEngineSettings$chklistEngines SettingCheckBox$14 parameter, ctl00$MPH$ucSiteSeoSettings$txtSeoMaxKeywords SettingText parameter, or ctl00 MPH grdLogLocations HiddenLSR parameter, by using a leading and trailing & (ampersand) character.

Recommendations For SmarterTools SmarterStats version 6.0, consider restricting access to the affected parameters until a patch is available. As a temporary workaround, avoid using the parameters ctl00$MPH$txtAdminNewPassword SettingText, ctl00$MPH$txtSmarterLogDirectory, ctl00$MPH$ucSiteSeoSearchEngineSettings$chklistEngines SettingCheckBox$14, ctl00$MPH$ucSiteSeoSettings$txtSeoMaxKeywords SettingText, and ctl00 MPH grdLogLocations HiddenLSR in the "Admin/frmSite.aspx" endpoint. Additionally, be cautious with the STTTState cookie to minimize the risk of exploitation.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2011-2148

Affected Products

Smarterstats

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-2148 · Security Note
• http://kb.cert.org/vuls/id/240150 · Note
• http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2148 · Note
• http://kb.cert.org/vuls/id/MORO-8GYQR4 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67834 · Note