vendor:
eZ Publish
by:
s4avrd0w
9.3
CVSS
HIGH
OS Command Injection
78
CWE
Product Name: eZ Publish
Affected Version From: 3.9.2000
Affected Version To: 3.10.2001
Patch Exists: YES
Related CWE: N/A
CPE: a:ezpublish:ez_publish
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
eZ Publish OS Commanding executing exploit
eZ Publish OS Commanding executing exploit is a zero-day exploit that allows an attacker to execute arbitrary OS commands on the vulnerable eZ Publish versions 3.x. The exploit requires the attacker to have the login credentials of an existing admin on eZ Publish. The attacker can then use the exploit to send a malicious payload to the target eZ Publish admin interface and execute arbitrary OS commands.
Mitigation:
Upgrade to the latest version of eZ Publish and ensure that the admin credentials are secure.
