critical10.0
CVE-2011-10017
Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts.
Impact
Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and can result in full compromise of the underlying system.
Affected products
| Product | Affected versions |
|---|---|
| Snort Report | before 1.3.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/snortreport_exec.rb
- https://web.archive.org/web/20111003093911/http://www.symmetrixtech.com/articles/news-016.html
- https://www.exploit-db.com/exploits/17947
- https://www.vulncheck.com/advisories/snort-report-rce