PT-2022-28265

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue concerns the use of shell exec and exec functions, which were not properly escaping filenames and configuration settings in most cases. Recommendations At the moment, there is n...

CVE-2021-44981

In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shellexec''; function without properly sanitizing any shell arguments, therefore remote code execution is possible. Additionally, as the media server is running as root by...

PT-2022-12279

Name of the Vulnerable Software and Affected Versions QuickBox Pro versions 2.5.8 and below Description The issue allows for remote code execution due to a variable in the config.php file that takes a GET parameter value and parses it into a shell exec function without properly sanitizing shell...

PT-2021-20057

Name of the Vulnerable Software and Affected Versions KLog Server versions 2.4.1 and earlier Description The issue allows authenticated command injection. This is because async.php calls shell exec on the original value of the source parameter. Recommendations For versions 2.4.1 and earlier,...

PT-2019-13082

Name of the Vulnerable Software and Affected Versions Centreon versions 18.x through 18.10.5 Centreon versions 19.x through 19.04.2 Centreon web versions prior to 2.8.29 Description The issue allows an attacker to execute arbitrary system commands. This is achieved by using the value init script ...

PT-2017-10202

Name of the Vulnerable Software and Affected Versions Sophos Web Appliance version 4.2.1.3 Description The issue affects the web administrative interface of the Sophos Web Appliance, specifically in the MgrReport.php component, which handles blocking and unblocking IP addresses. The problem arise...

PfSense命令注入漏洞

漏洞简介 该漏洞的编号为CVE-2014-4688，存在于PfSense的2.1.3以及更低版本中。该漏洞源于php程序中没有对用户的输入值进行严格的校验，导致用户恶意输入达到命令执行函数时会产生严重后果。其中，diagdns.php， diagsmart.php， statusrrdgraphimg.php三个脚本文件受到该漏洞的影响。 漏洞分析 在diagdns.php中，用户提交的host值经过处理后将传到dig变量中执行。攻击者通过构造host值执行任意命令。...

e-Commerce Vision Design Group Code injection Vulnerability

Exploit for php platform in category web applications Exploit Title: e-Commerce Vision Design Group Code injection Date: 10/09/2014 Exploit Author: MindCracker - Team MaDLeeTs Contact : email protected | FB.Com/Pakistani1337 Greetz : KhantastiC - b0x - 1337 - H4x0rl1f3 - Shadow008 - Invectus...