PT-2022-9919 · Unknown · Northstar Club Management

Alexandre Larocque · Published 2022-02-04 · Updated 2022-02-09 · CVE-2021-29393

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NorthStar Club Management version 6.3

Description The issue allows remote unauthenticated users to inject and execute arbitrary system commands via the unsanitized user-controlled command and commandvalues parameters in cominput.jsp and comoutput.jsp.

Recommendations For NorthStar Club Management version 6.3, consider sanitizing the command and commandvalues parameters in cominput.jsp and comoutput.jsp to prevent remote code execution. As a temporary workaround, restrict access to these pages to minimize the risk of exploitation.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-29393

Affected Products

Northstar Club Management

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-29393 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29393 · Vendor Advisory
• https://ardent-security.com · Note
• https://ardent-security.com/en/advisory/asa-2021-01 · Note
• https://t.me/cibsecurity/36879 · Telegram Post