CVE-2020-12078

CVE-2020-12078 - Open-AudIT 3.3.1 : A shell metacharacter injection flaw exists in the open-audit/configuration/ URI. The exclude_ip value from global discovery settings is passed to an unfiltered exec in discoveries_helper.php (inside all_ip_list), allowing a payload to execute commands. Connect...

PT-2020-13030

Name of the Vulnerable Software and Affected Versions Open-AudIT version 3.3.1 Description An issue was discovered in Open-AudIT where shell metacharacter injection is possible via attributes to an "open-audit/configuration/" URI. An attacker can exploit this by adding an excluded IP address to t...