CVE-2012-10041
CRITICALWAN Emulator 2.3 - Unauthenticated OS Command Injection via result.php pc Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-10041.
PoCs published by Metasploit, bcoles, including Metasploit module exploits/linux/http/wanem_exec.
AI-analyzed exploit summary This Metasploit module exploits a command execution vulnerability in WAN Emulator v2.3 via the 'result.php' script, allowing unauthenticated RCE as 'www-data' and privilege escalation to root via the 'dosu' binary.
Description
WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shell_exec() with unsanitized input from the pc POST parameter, allowing remote attackers to execute arbitrary commands as the www-data user. The system also includes a SUID-root binary named dosu, which is vulnerable to command injection via its first argument. An attacker can exploit both flaws in sequence to achieve full remote code execution and escalate privileges to root.
Exploits (2)
This Metasploit module exploits a command execution vulnerability in WAN Emulator v2.3 via the 'result.php' script, allowing unauthenticated RCE as 'www-data' and privilege escalation to root via the 'dosu' binary.
This Metasploit module exploits a command execution vulnerability in WAN Emulator v2.3 via the 'result.php' script, which calls shell_exec() with user-controlled data from the 'pc' parameter. It also leverages a suid binary 'dosu' for privilege escalation to root.
References (4)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N