CVE-2004-1456

CVStrac - Remote Code Execution via Shell Metacharacters in rcsinfo

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-1456. PoCs published by anonymous.

AI-analyzed exploit summary This exploit targets a file disclosure vulnerability in CVS (Concurrent Versions System) by manipulating the 'filediff' parameter to access sensitive files like 'CVSROOT/rcsinfo'. It leverages improper input validation to retrieve arbitrary file contents.

Description

filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo.

Exploits (1)

exploitdb WORKING POC VERIFIED

by anonymous · textremotelinux

https://www.exploit-db.com/exploits/379

View Code ZIP pw:eip

This exploit targets a file disclosure vulnerability in CVS (Concurrent Versions System) by manipulating the 'filediff' parameter to access sensitive files like 'CVSROOT/rcsinfo'. It leverages improper input validation to retrieve arbitrary file contents.

Classification

Working Poc 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: CVS (Concurrent Versions System) versions prior to fix for CVE-2004-1456

No auth needed

Prerequisites: access to the CVS web interface

MITRE ATT&CK