|
Family: CGI abuses --> Category: attack
Sysinfo name Parameter Code Execution Vulnerability Vulnerability Scan
Vulnerability Scan Summary Tries to execute arbitrary code using Sysinfo
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a Perl script that is susceptible to
arbitrary command execution attacks.
Description :
The remote host is running Sysinfo, a web-based system monitor.
The version of Sysinfo installed on the remote host fails to sanitize
user-supplied input to the 'name' parameter before passing it to a
shell for execution. An unauthenticated attacker may be able to
exploit this issue to execute arbitrary shell commands on the remote
host subject to the rights of the web server user id.
See also :
http://downloads.securityfocus.com/vulnerabilities/exploits/sysinfo_poc
Solution :
Upgrade to Sysinfo version 2.25 or later.
Threat Level:
High / CVSS Base Score : 7
(AV:R/AC:L/Au:NR/C:P/A:P/I:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|