PT-2012-1934 · Spamtitan · Webtitan
Published
2012-10-08
·
Updated
2012-10-08
·
CVE-2011-4639
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
SpamTitan WebTitan versions prior to 3.60
Description
The issue concerns the Traceroute and Ping implementations in tools.php, allowing remote authenticated users to execute arbitrary commands via shell metacharacters in an argument. This can be achieved by using sequences such as && (ampersand ampersand).
Recommendations
For versions prior to 3.60, update to version 3.60 or later to resolve the issue. As a temporary workaround, consider restricting access to the tools.php file to minimize the risk of exploitation. Avoid using shell metacharacters in arguments for the Traceroute and Ping implementations until the issue is resolved.
Exploit
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Webtitan