A command injection vulnerability exists in TeemIp versions before 2.4.0. The new_config parameter of exec.php allows one to create a new PHP file with the exception of config information. The malicious PHP code sent is executed instantaneously and is not saved on the server.
References
Link | Resource |
---|---|
https://pentest.com.tr/exploits/TeemIp-IPAM-2-4-0-new-config-Command-Injection-Metasploit.html | Exploit Patch Third Party Advisory |
https://www.exploit-db.com/exploits/46641 | Exploit Patch Third Party Advisory VDB Entry |
https://www.exploit-db.com/exploits/46641/ | Exploit Third Party Advisory VDB Entry |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2019-04-04T17:07:13
Updated: 2019-04-20T00:06:05
Reserved: 2019-04-04T00:00:00
Link: CVE-2019-10863
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-04-04T18:29:00.637
Modified: 2020-08-24T17:37:01.140
Link: CVE-2019-10863
JSON object: View
Redhat Information
No data.
CWE