CVE-2007-6459

Anon Proxy Server 0.100, and probably 0.101, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the host parameter to diagdns.php, and (2) the host parameter and possibly (3) the port parameter to diagconnect.php, a different vulnerability than CVE-2007-6460.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/43711
http://osvdb.org/43712
http://securityreason.com/securityalert/3463
http://www.securityfocus.com/archive/1/485151/100/0/threaded
http://www.securityfocus.com/bid/26882	Exploit
https://www.exploit-db.com/exploits/4734

Configurations

Configuration 1 (hide)

cpe:2.3:a:anon_proxy_server:anon_proxy_server:0.100:*:*:*:*:*:*:*

History

No history.

Information

Published : 2007-12-20 00:46

Updated : 2024-02-04 17:13

NVD link : CVE-2007-6459

Mitre link : CVE-2007-6459

CVE.ORG link : CVE-2007-6459

JSON object : View

Products Affected

anon_proxy_server

anon_proxy_server

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2007-6459", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-12-20T00:46:00.000", "references": [{"url": "http://osvdb.org/43711", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/43712", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/3463", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/485151/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/26882", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/4734", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Anon Proxy Server 0.100, and probably 0.101, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the host parameter to diagdns.php, and (2) the host parameter and possibly (3) the port parameter to diagconnect.php, a different vulnerability than CVE-2007-6460."}, {"lang": "es", "value": "Anon Proxy Server 0.100, y probablemente 0.101, permite a atacantes remotos ejecutar comandos de su elecci\u00f3n mediante meta-caracteres de shell en (1) el par\u00e1metro host a diagdns.php, y (2) el par\u00e1metro host y posiblemente (3) el par\u00e1metro port a diagconnect.php, una vulnerabilidad diferente de CVE-2007-6460."}], "lastModified": "2018-10-15T21:54:30.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:anon_proxy_server:anon_proxy_server:0.100:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B45F8F2-06A9-4CC5-9A38-450205F100B0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}