header-logo
Suggest Exploit
vendor:
AOLServer
by:
7.5
CVSS
HIGH
Command Injection
78
CWE
Product Name: AOLServer
Affected Version From: 4.5.2001
Affected Version To:
Patch Exists: NO
Related CWE:
CPE: a:aol:aolserver:4.5.1
Metasploit:
Other Scripts:
Platforms Tested:

AOLServer Command Injection Vulnerability

AOLServer is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles. Attackers can exploit this issue to execute arbitrary commands in a terminal. The following example is available: echo -en "GET /x1b]2;owned?x07x0ax0dx0ax0d" > payload nc www.example.com 80 < payload

Mitigation:

It is recommended to sanitize user-supplied input to prevent command injection attacks. Regularly update AOLServer to the latest version to mitigate this vulnerability.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/37712/info

AOLServer is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

AOLServer 4.5.1 is vulnerable; other versions may also be affected.

The following example is available:

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc www.example.com 80 < payload

Navigation

Suggest Exploit

Services By CQR