|CVSS SCORE||9.3, (AV:N/AC:M/Au:N/C:C/I:C/A:C)|
|TREND MICRO CUSTOMER PROTECTION||Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['28816']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com|
The specific flaw exists within genratereports.php. The issue lies in the failure to properly validate a user-supplied command prior to using it in system calls. The more general flaw is that the software trusts responses from a server that is specified by a user and can be induced to execute commands from that server. An attacker can leverage this vulnerability to execute arbitrary code under the context of SYSTEM.
07/01/2016 - ZDI reported the vulnerability to a previous known contact with this vendor
|CREDIT||Steven Seeley of Source Incite