vendor:
NAS4Free
by:
Brandon Perry
7,5
CVSS
HIGH
Remote Code Execution
78
CWE
Product Name: NAS4Free
Affected Version From: 9.1.0.1.804
Affected Version To: 9.1.0.1.804
Patch Exists: YES
Related CWE: CVE-2013-3631
CPE: NAS4Free
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2013
NAS4Free Arbitrary Remote Code Execution
NAS4Free allows an authenticated user to post PHP code to a special HTTP script and have the code executed remotely. This module was successfully tested against NAS4Free version 9.1.0.1.804. Earlier builds are likely to be vulnerable as well.
Mitigation:
Authentication should be enabled and users should be assigned with least privileges.
