PT-2020-7270 · Unknown · Bulb Security Smartphone Pentest Framework

Published 2020-01-03 · Updated 2020-01-15 · CVE-2012-5878

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Bulb Security Smartphone Pentest Framework (SPF) versions 0.1.2 through 0.1.4

Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the appURLPath parameter to frameworkgui/attachMobileModem.pl.

Recommendations: For versions 0.1.2 through 0.1.4, consider disabling the SEAttack.pl and CSAttack.pl scripts in frameworkgui/ and restrict access to the attachMobileModem.pl script until a patch is available. Avoid using the hostingPath and appURLPath parameters in the affected scripts until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2012-5878

Affected Products

Bulb Security Smartphone Pentest Framework

References · 6

• 🔥 https://exploit-db.com/exploits/38114 · Exploit
• 🔥 https://htbridge.com/advisory/HTB23127 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5878 · Security Note
• https://htbridge.com/advisory/HTB23123 · Note
• https://t.me/cibsecurity/8994 · Telegram Post
• https://t.me/cibsecurity/8995 · Telegram Post