CVE-2011-10017
CRITICALSnort Report < 1.3.2 - Unauthenticated Remote Code Execution via nmap.php and nbtscan.php Target Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-10017.
PoCs published by Metasploit, Paul Rascagneres, including Metasploit module exploits/multi/http/snortreport_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Snortreport's nmap.php and nbtscan.php scripts by injecting a base64-encoded payload into the 'target' parameter, leading to remote command execution.
Description
Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and can result in full compromise of the underlying system.
Exploits (2)
This Metasploit module exploits a command injection vulnerability in Snortreport's nmap.php and nbtscan.php scripts by injecting a base64-encoded payload into the 'target' parameter, leading to remote command execution.
This Metasploit module exploits a command injection vulnerability in Snortreport's nmap.php/nbtscan.php scripts by injecting a base64-encoded payload into the 'target' parameter, achieving remote command execution.
References (4)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H