what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

OSVDB: OSVDB-90230

OpenPLI Webif Arbitrary Command Execution

Posted Mar 15, 2013

Authored by Michael Messner | Site metasploit.com

Some Dream Boxes with OpenPLI version 3 beta images are vulnerable to OS command injection in the Webif 6.0.4 web interface. This is a blind injection, which means that you will not see any output of your command. A ping command can be used for testing the vulnerability. This Metasploit module has been tested in a box with the next features: Linux Kernel version 2.6.9 (build@plibouwserver) (gcc version 3.4.4) #1 Wed Aug 17 23:54:07 CEST 2011, Firmware release 1.1.0 (27.01.2013), FP Firmware 1.06 and Web Interface 6.0.4-Expert (PLi edition).

tags | exploit, web, kernel

systems | linux

advisories | OSVDB-90230

SHA-256 | 08146370ff7e87193e0ac650501ba578d139728fdb5da79083867c3d68983b6c

Download | Favorite | View