high7.2Public exploit code
CVE-2016-5840
hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
Impact
hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Trend Micro | Deep Discovery Inspector | Versions 3.7, 3.81, 3.82 |
Weakness classification
References
- NVD record
- CVE.org record
- http://esupport.trendmicro.com/solution/en-US/1114281.aspx
- http://jvn.jp/en/jp/JVN55428526/index.html
- http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000103.html
- http://www.zerodayinitiative.com/advisories/ZDI-16-373
- https://www.exploit-db.com/exploits/40180/
- http://esupport.trendmicro.com/solution/en-US/1114281.aspx
- http://jvn.jp/en/jp/JVN55428526/index.html
- http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000103.html
- http://www.zerodayinitiative.com/advisories/ZDI-16-373
- https://www.exploit-db.com/exploits/40180/