CVE-2009-2288
EXPLOITEDNagios < 3.1.1 - OS Command Injection via statuswml.cgi Ping or Traceroute Parameters
Title source: llmExploitation Summary
CVE-2009-2288 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 4 public exploits from researchers including Metasploit, H D Moore, Paul, including a Metasploit module exploits/unix/webapp/nagios3_statuswml_ping.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Nagios3's statuswml.cgi script by injecting shell metacharacters into the 'ping' parameter, allowing arbitrary command execution.
Description
statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.
Exploits (4)
This Metasploit module exploits a command injection vulnerability in Nagios3's statuswml.cgi script by injecting shell metacharacters into the 'ping' parameter, allowing arbitrary command execution.
This Metasploit module exploits a command injection vulnerability in Nagios3's statuswml.cgi script by injecting shell metacharacters into the 'ping' parameter, allowing arbitrary command execution. It authenticates with provided credentials and sends a crafted POST request to trigger the payload.
This exploit demonstrates a command injection vulnerability in Nagios via the WAP interface's ping feature. The URI example shows how arbitrary shell commands can be executed by appending them to the ping parameter.
This Metasploit module exploits a metacharacter injection vulnerability in Nagios3's statuswml.cgi script, allowing remote command execution via the 'ping' parameter. It sends a crafted POST request with shell metacharacters to execute arbitrary commands.