CVE-2014-5502: Improper Neutralization of Special Elements used in an OS Command

The Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote authenticated users to inject arbitrary commands via a 1 checkcertkey, 2 webclientportalsettings, 3 sslvpnliveuserdelete, or 4 cccflushsqlfile opcode...

Sophos Cyberoam checkcert_key Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sophos Cyberoam. Authentication is required to exploit this vulnerability. The specific flaw exists within the checkcertkey opcode. The issue lies in the failure to properly sanitize user-supplied...