CVE-2007-3011

Fujitsu-Siemens Computers ServerView <4.50.09 - Command Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-3011. PoCs published by RedTeam Pentesting GmbH.

AI-analyzed exploit summary This exploit demonstrates a command injection vulnerability in Fujitsu ServerView via the 'Servername' parameter in the 'DBAsciiAccess' CGI script. The vulnerability allows remote command execution by appending commands to the 'Servername' parameter, which are then executed on the server.

Description

The DBAsciiAccess CGI Script in the web interface in Fujitsu-Siemens Computers ServerView before 4.50.09 allows remote attackers to execute arbitrary commands via shell metacharacters in the Servername subparameter of the ParameterList parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by RedTeam Pentesting GmbH · textremotemultiple

https://www.exploit-db.com/exploits/30264

View Code ZIP pw:eip

This exploit demonstrates a command injection vulnerability in Fujitsu ServerView via the 'Servername' parameter in the 'DBAsciiAccess' CGI script. The vulnerability allows remote command execution by appending commands to the 'Servername' parameter, which are then executed on the server.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Fujitsu ServerView prior to 4.50.09

No auth needed

Prerequisites: Network access to the target server · Fujitsu ServerView CGI interface exposed

MITRE ATT&CK