vendor:
Changetrack
by:
Marek Grzybowski
7.2
CVSS
HIGH
Privilege Escalation
264
CWE
Product Name: Changetrack
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Changetrack Privilege Escalation Vulnerability
A vulnerability has been discovered in Changetrack, which can be exploited by malicious, local users to gain escalated privileges. The application does not properly escape certain file names, which can be exploited to inject and execute arbitrary shell commands (potentially with "root" privileges) by creating a maliciously named file in a directory tracked by Changetrack. Successful exploitation requires write privileges to a directory scanned by Changetrack.
Mitigation:
Use Changetrack to track trusted directories only.
