Description
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Portcullis · textwebappsphp
https://www.exploit-db.com/exploits/35100
References (3)
Core 3
Core References
Exploit mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Oct/121
Exploit x_refsource_misc
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-7178/
Vendor Advisory x_refsource_confirm
https://www.tuleap.org/recent-vulnerabilities
Scores
EPSS
0.1039
EPSS Percentile
93.2%
Details
CWE
CWE-20
Status
published
Products (1)
enalean/tuleap
< 7.5.99.5
Published
Nov 28, 2014
Tracked Since
Feb 18, 2026