CVE-2007-5208
HP Linux Imaging and Printing Project < 2.7.10 - OS Command Injection via Sendmail From Address
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-5208.
PoCs published by Metasploit, jduck, including Metasploit module exploits/linux/misc/hplip_hpssd_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in the hpssd.py daemon of HP Linux Imaging and Printing (hplip) versions before 2.7.10. It leverages the 'email-from-address' field in the 'setalerts' request to execute arbitrary commands via shell metacharacters.
Description
hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail.
Exploits (2)
This Metasploit module exploits a command injection vulnerability in the hpssd.py daemon of HP Linux Imaging and Printing (hplip) versions before 2.7.10. It leverages the 'email-from-address' field in the 'setalerts' request to execute arbitrary commands via shell metacharacters.
This Metasploit module exploits a command injection vulnerability in HPLIP's hpssd.py daemon (CVE-2007-5208) by injecting arbitrary commands into the 'email-from-address' field, which are executed when the daemon sends a test email. The exploit requires the 'sendmail' command to be present on the target system.