header-logo
Suggest Exploit
vendor:
Network Tool
by:
Rick Fournier
7.5
CVSS
HIGH
Arbitrary Command Execution
78
CWE
Product Name: Network Tool
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002

Network Tool PHPNuke Addon Arbitrary Command Execution Vulnerability

Network Tool is a PHPNuke addon, written and maintained by Rick Fournier. It is designed to offer network features such as nmap, traceroute, and ping from a web interface. A problem with the package has been discovered that could allow remote users to gain arbitrary access to restricted resources. The problem is in the filtering of metacharacters by the interface. A command passed to the modules in the suite could be encapsulated in metacharacters, and would result in the command being executed on the system with the permissions of the httpd process. This makes it possible for a remote user to execute arbitrary commands, and potentially gain access to a vulnerable host. Asking the Php script for Pinging, Nmap, or traceroute this kind of adresse <www.somehost.com;ls -al> will allow any user to run " ls -al " command as whatever user runs the web server.

Mitigation:

The vendor has released a patch to address this issue. Users should upgrade to the latest version of the software.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/3552/info

Network Tool is a PHPNuke addon, written and maintained by Rick Fournier. It is designed to offer network features such as nmap, traceroute, and ping from a web interface.

A problem with the package has been discovered that could allow remote users to gain arbitrary access to restricted resources. The problem is in the filtering of metacharacters by the interface. A command passed to the modules in the suite could be encapsulated in metacharacters, and would result in the command being executed on the system with the permissions of the httpd process.

This makes it possible for a remote user to execute arbitrary commands, and potentially gain access to a vulnerable host. 

Asking the Php script for Pinging, Nmap, or traceroute this kind of adresse
<www.somehost.com;ls -al> will allow any user to run " ls -al " command as whatever user runs the web server.