critical9.8Public exploit code
CVE-2014-9611
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Netsweeper 3.0.6 - Authentication Bypass2015-08-21 · webapps · php
Impact
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Netsweeper | Netsweeper | through 4.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html
- https://www.exploit-db.com/exploits/37931/
- http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html
- https://www.exploit-db.com/exploits/37931/