PT-2020-7264

Name of the Vulnerable Software and Affected Versions: Bulb Security Smartphone Pentest Framework SPF versions prior to 0.1.3 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in various parameters to different scripts in the frameworkgui...

CVE-2012-5878: Improper Neutralization of Special Elements used in an OS Command

Bulb Security Smartphone Pentest Framework SPF 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to 1 SEAttack.pl or 2 CSAttack.pl in frameworkgui/ or the 3 appURLPath parameter to frameworkgui/attachMobileModem.pl...

CVE-2012-5693: Improper Neutralization of Special Elements used in an OS Command

Bulb Security Smartphone Pentest Framework SPF before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to 1 remoteAttack.pl or 2 guessPassword.pl in frameworkgui/; the filename parameter to 3 CSAttack.pl or 4 SEAttack.pl in...

PT-2020-7270

Name of the Vulnerable Software and Affected Versions: Bulb Security Smartphone Pentest Framework SPF versions 0.1.2 through 0.1.4 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to 1 SEAttack.pl or 2 CSAttack.pl i...

Sql injection

Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework SPF before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the 1 agentPhNo, 2 controlPhNo, 3 agentURLPath, 4 agentControlKey, or 5 platformDD1 parameter to frameworkgui/attach2Agents.pl; the 6...

CVE-2012-5695: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Bulb Security Smartphone Pentest Framework SPF 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct 1 shell metacharacter or 2 SQL injection attacks or 3 send an SMS message...

PT-2014-2357

Name of the Vulnerable Software and Affected Versions Bulb Security Smartphone Pentest Framework SPF versions prior to 0.1.3 Description The issue allows remote attackers to obtain the plaintext database password due to improper access restrictions to frameworkgui/config. Recommendations For...

PT-2014-2356

Name of the Vulnerable Software and Affected Versions Bulb Security Smartphone Pentest Framework SPF versions 0.1.2 through 0.1.4 Description The issue allows remote attackers to hijack the authentication of administrators for requests, potentially leading to shell metacharacter, SQL injection...

CVE-2012-5696: Undefined Security Weakness

Bulb Security Smartphone Pentest Framework SPF before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request...

PT-2014-2358

Name of the Vulnerable Software and Affected Versions Bulb Security Smartphone Pentest Framework SPF versions prior to 0.1.3 Description The issue concerns the btinstall installation script in the framework, which sets weak permissions for files in a specific directory. This allows local users to...

CVE-2012-5694: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework SPF before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the 1 agentPhNo, 2 controlPhNo, 3 agentURLPath, 4 agentControlKey, or 5 platformDD1 parameter to frameworkgui/attach2Agents.pl; the 6...

PT-2014-2355

Name of the Vulnerable Software and Affected Versions Bulb Security Smartphone Pentest Framework SPF versions prior to 0.1.3 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via various parameters to different scripts within the frameworkgui...

CVE-2012-5697: Undefined Security Weakness

The btinstall installation script in Bulb Security Smartphone Pentest Framework SPF before 0.1.3 uses weak permissions 777 for all files in the frameworkgui/ directory, which allows local users to obtain sensitive information or inject arbitrary Perl code via direct access to these files...