CVE-2012-10033
CRITICALNarcissus backend.php - release Parameter Command Injection
Title source: manualExploitation Summary
EIP tracks 3 public exploits for CVE-2012-10033.
PoCs published by Metasploit, dun, Dun, sinn3r, including Metasploit module exploits/unix/webapp/narcissus_backend_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Narcissus' backend.php via the 'release' parameter, allowing remote code execution under the context of the web server. It leverages the passthru PHP function to execute arbitrary commands.
Description
Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context.
Exploits (3)
This Metasploit module exploits a command injection vulnerability in Narcissus' backend.php via the 'release' parameter, allowing remote code execution under the context of the web server. It leverages the passthru PHP function to execute arbitrary commands.
This exploit demonstrates a command injection vulnerability in Narcissus' backend.php. The 'release' parameter is passed unsanitized to a shell command via passthru(), allowing arbitrary command execution.
This Metasploit module exploits a command injection vulnerability in Narcissus' backend.php via the $release parameter, allowing remote code execution through the passthru PHP function. The exploit sends a crafted POST request to execute arbitrary commands.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N