Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to (1) remoteAttack.pl or (2) guessPassword.pl in frameworkgui/; the filename parameter to (3) CSAttack.pl or (4) SEAttack.pl in frameworkgui/; the phNo2Attack parameter to (5) CSAttack.pl or (6) SEAttack.pl in frameworkgui/; the (7) platformDD2 parameter to frameworkgui/SEAttack.pl; the (8) agentURLPath or (9) agentControlKey parameter to frameworkgui/attach2agents.pl; or the (10) controlKey parameter to frameworkgui/attachMobileModem.pl. NOTE: The hostingPath parameter to CSAttack.pl and SEAttack.pl vectors and the appURLPath parameter to attachMobileModem.pl vector are covered by CVE-2012-5878.
References
Link | Resource |
---|---|
https://www.htbridge.com/advisory/HTB23123 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-01-03T19:30:24
Updated: 2020-01-03T19:30:24
Reserved: 2012-10-29T00:00:00
Link: CVE-2012-5693
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-01-03T20:15:10.903
Modified: 2020-01-17T15:17:01.877
Link: CVE-2012-5693
JSON object: View
Redhat Information
No data.
CWE