CVE-2013-4983
Sophos Web Appliance <3.7.9.1, <3.8.1.1 - Command Injection
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2013-4983.
PoCs published by Metasploit, Francisco Falcon, juan vazquez, including Metasploit module exploits/linux/http/sophos_wpa_sblistpack_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Sophos Web Protection Appliance versions 3.7.9, 3.8.0, and 3.8.1 via the sblistpack component, allowing arbitrary command execution without authentication.
Description
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to end-user/index.php.
Exploits (3)
This Metasploit module exploits a command injection vulnerability in Sophos Web Protection Appliance versions 3.7.9, 3.8.0, and 3.8.1 via the sblistpack component, allowing arbitrary command execution without authentication.
The exploit demonstrates a pre-authentication OS command injection vulnerability in Sophos Web Protection Appliance, allowing unauthenticated remote attackers to execute arbitrary commands via crafted POST parameters. The provided Python script triggers a reverse shell by injecting a malicious payload into the 'domain' parameter.
This Metasploit module exploits a command injection vulnerability in Sophos Web Protection Appliance versions 3.7.9, 3.8.0, and 3.8.1 via the sblistpack component. It leverages an unauthenticated POST request to execute arbitrary commands by injecting payloads into the 'domain' parameter.