medium6.0Public exploit code
CVE-2013-3631
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- NAS4Free - Remote Code Execution (Metasploit)2013-10-31 · remote · php · Verified
Impact
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nas4free | Nas4free | through 9.1.0.1.804 Version 9.1.0.1.798 |