CVE-2007-3010

Related Files

Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution

Posted Oct 27, 2009

Authored by patrick

This Metasploit module abuses a metacharacter injection vulnerability in the HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 and earlier. The Unified Maintenance Tool contains a 'masterCGI' binary which allows an unauthenticated attacker to execute arbitrary commands by specifying shell metacharacters as the 'user' within the 'ping' action to obtain 'httpd' user access. This module only supports command line payloads, as the httpd process kills the reverse/bind shell spawn after the HTTP 200 OK response.

tags | exploit, web, arbitrary, shell

advisories | CVE-2007-3010

SHA-256 | 5f729c464589be1bd553b1af7b924cba42e213fffa0fc22238f2714175028981

Download | Favorite | View

rt-sa-2007-001.txt

Posted Sep 18, 2007

Site redteam-pentesting.de

Alcatel-Lucent OmniPCX suffers from a remote command execution vulnerability. Details provided.

tags | exploit, remote

advisories | CVE-2007-3010

SHA-256 | 2f285ee1ca4f7cd8d73a0bd45509d5332a7980bc9f886d9b434baacc93dcccd6

Download | Favorite | View