CVE-2009-1792

StoneTrip S3DPlayer StandAlone 1.6.2.4 and 1.7.0.1 and Web 1.6.0.0 - Remote Code Execution via system.openURL

Title source: llm
STIX 2.1

Description

The system.openURL function in StoneTrip Ston3D StandalonePlayer (aka S3DPlayer StandAlone) 1.6.2.4 and 1.7.0.1 and WebPlayer (aka S3DPlayer Web) 1.6.0.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the first argument (the sURL argument).

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/35105
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35256
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/503887/100/0/threaded

Scores

EPSS 0.0354
EPSS Percentile 87.9%

Details

CWE
CWE-78
Status published
Products (3)
stonetrip/s3dplayer_standalone 1.6.2.4
stonetrip/s3dplayer_standalone 1.7.0.1
stonetrip/s3dplayer_web 1.6.0.0
Published May 29, 2009
Tracked Since Feb 18, 2026