CVE-2013-3576
HP System Management Homepage - Authenticated OS Command Injection via PATH_INFO to smhutil/snmpchp.php.en
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-3576.
PoCs published by Metasploit, Markus Wulftange, sinn3r, including Metasploit module exploits/multi/http/hp_sys_mgmt_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in HP System Management Homepage by manipulating the 'tempfilename' variable in the JustGetSNMPQueue function, leading to arbitrary code execution under the SYSTEM context.
Description
ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en.
Exploits (2)
This Metasploit module exploits a command injection vulnerability in HP System Management Homepage by manipulating the 'tempfilename' variable in the JustGetSNMPQueue function, leading to arbitrary code execution under the SYSTEM context.
This Metasploit module exploits a command injection vulnerability in HP System Management Homepage by manipulating the 'tempfilename' variable in the JustGetSNMPQueue function, leading to remote code execution via a crafted HTTP request.