vendor:
FHFS
by:
Naser Farhadi
9,3
CVSS
HIGH
Remote Command Execution
78
CWE
Product Name: FHFS
Affected Version From: 2.1.2
Affected Version To: 2.1.2
Patch Exists: YES
Related CWE: N/A
CPE: a:fhfs:fhfs
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 7 SP1 (32 bit)
2015
FHFS – FTP/HTTP File Server 2.1.2 Remote Command Execution
FHFS is a FTP and HTTP Web Server package, transparently based on HFS and FileZilla. A vulnerability exists in FHFS version 2.1.2 which allows an attacker to execute arbitrary commands on the server by sending a specially crafted HTTP request. This can be exploited by sending a GET request with a specially crafted parameter to the vulnerable server.
Mitigation:
Upgrade to the latest version of FHFS.