Exploitation Summary
EIP tracks 2 public exploits for CVE-2014-7285.
PoCs published by Metasploit, Egidio Romano, sinn3r, including Metasploit module exploits/linux/http/symantec_web_gateway_restore.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Symantec Web Gateway's restore.php feature. It authenticates, injects a payload via a crafted filename in a multipart form, and executes arbitrary commands under the context of the HTTP service.
Description
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.
Exploits (2)
This Metasploit module exploits a command injection vulnerability in Symantec Web Gateway's restore.php feature. It authenticates, injects a payload via a crafted filename in a multipart form, and executes arbitrary commands under the context of the HTTP service.
This Metasploit module exploits a command injection vulnerability in Symantec Web Gateway's restore.php feature. It authenticates, injects a payload via a crafted filename in a multipart form, and executes arbitrary commands under the HTTP service context.