CVE-2009-3233
changetrack 4.3 - OS Command Injection via Filename with CRLF and Shell Metacharacters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-3233. PoCs published by Rick.
AI-analyzed exploit summary This exploit demonstrates a local privilege escalation vulnerability in Changetrack due to improper escaping of filenames. By creating a maliciously named file, an attacker can execute arbitrary shell commands with root privileges when Changetrack processes the directory.
Description
changetrack 4.3 allows local users to execute arbitrary commands via CRLF sequences and shell metacharacters in a filename in a directory that is checked by changetrack.
Exploits (1)
This exploit demonstrates a local privilege escalation vulnerability in Changetrack due to improper escaping of filenames. By creating a maliciously named file, an attacker can execute arbitrary shell commands with root privileges when Changetrack processes the directory.