CVE-2009-2288

Public PoC / Exploit (4)

Exploit-DBNagios 3.0.6 - 'statuswml.cgi' Arbitrary Shell Command Injection Exploit-DBNagios3 - 'statuswml.cgi' 'Ping' Command Execution (Metasploit)Exploit-DBNagios3 - 'statuswml.cgi' Command Injection (Metasploit)TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.

Weaknesses (CWE)

CWE-78

Affected Products (32)

nagios · nagiosvulnerable

References (20)

http://marc.info/?l=bugtraq&m=126996888626964&w=2

http://secunia.com/advisories/35543

Vendor Advisory

http://secunia.com/advisories/35688

http://secunia.com/advisories/35692

http://secunia.com/advisories/39227

http://security.gentoo.org/glsa/glsa-200907-15.xml

http://tracker.nagios.org/view.php?id=15

Exploit

http://www.debian.org/security/2009/dsa-1825

http://www.nagios.org/development/history/core-3x/

http://www.securitytracker.com/id?1022503

http://www.ubuntu.com/usn/USN-795-1

http://www.vupen.com/english/advisories/2010/0750