CVE-2008-1331

OmniPCX Office - RCE

Title source: llm

Description

cgi-data/FastJSData.cgi in OmniPCX Office with Internet Access services OXO210 before 210/091.001, OXO600 before 610/014.001, and other versions, allows remote attackers to execute arbitrary commands and "obtain OXO resources" via shell metacharacters in the id2 parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by DSecRG · textwebappscgi

https://www.exploit-db.com/exploits/5662

View Code ZIP pw:eip

References (8)

[Third Party Advisory] http://secunia.com/advisories/29798

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/492383/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/28758

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1020082

[Permissions Required] http://www.vupen.com/english/advisories/2008/1057

[Vendor Advisory] http://www1.alcatel-lucent.com/psirt/statements/2008001/OXOrexec.htm

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/41560

[Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/5662

Scores

EPSS 0.5850

EPSS Percentile 98.2%

Classification

CWE

CWE-20

Status draft

Affected Products (1)

alcatel-lucent/omnipcx_office < 210\/091.001

Timeline

Published Apr 02, 2008

Tracked Since Feb 18, 2026