PT-2013-3102 · Os4Edu · Opensis

Egidio Romano · Published 2013-12-09 · Updated 2020-09-03 · CVE-2013-1349

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions openSIS versions 4.5 through 5.2

Description The issue allows remote attackers to execute arbitrary PHP code via the modname parameter in the "ajax.php" file.

Recommendations For openSIS versions 4.5 through 5.2, consider restricting access to the modname parameter in the "ajax.php" file until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-1349

Affected Products

Opensis

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/opensis_modname_exec.rb · Exploit
• 🔥 http://karmainsecurity.com/KIS-2013-10 · Exploit
• 🔥 https://exploit-db.com/exploits/30471 · Exploit
• 🔥 http://sourceforge.net/p/opensis-ce/code/1009 · Exploit
• 🔥 http://sourceforge.net/p/opensis-ce/bugs/59 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1349 · Security Note
• http://secunia.com/advisories/55913 · Vendor Advisory