Command injection

2007-04-2515:19:00

PRIOn knowledge base

www.prio-n.com

7.1 High

AI Score

Confidence

Low

0.016 Low

EPSS

Percentile

87.4%

JSON

cosign-bin/cosign.cgi in Cosign 2.0.2 and earlier allows remote authenticated users to perform unauthorized actions as an arbitrary user by using CR (\r) sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username.

CPENameOperatorVersion
cosigneq0.9.0
cosigneq1.6
cosigneq0.8.0
cosigneq1.0
cosigneq1.5
cosigneq1.8
cosigneq1.1
cosigneq1.8.5
cosigneq0.7.0
cosigneq2.0.1

Name	Operator	Version
cosign	eq	0.9.0
cosign	eq	1.6
cosign	eq	0.8.0
cosign	eq	1.0
cosign	eq	1.5
cosign	eq	1.8
cosign	eq	1.1
cosign	eq	1.8.5
cosign	eq	0.7.0
cosign	eq	2.0.1

Rows per page:

1-10 of 131

References

secunia.com/advisories/24845

www.securityfocus.com/archive/1/465386/100/100/threaded

www.umich.edu/~umweb/software/cosign/cosign-vuln-2007-002.txt

www.vupen.com/english/advisories/2007/1359