Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-9605. PoCs published by Anastasios Monachos.
AI-analyzed exploit summary This exploit demonstrates an authentication bypass vulnerability in Netsweeper 4.0.8 via SQL injection using two single quotes in the login and password fields. It allows unauthorized admin access to perform actions like system backup, server restart, and stopping filters.
Description
WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webupgrade/webupgrade.php. NOTE: this was originally reported as an SQL injection vulnerability, but this may be inaccurate.
Exploits (1)
This exploit demonstrates an authentication bypass vulnerability in Netsweeper 4.0.8 via SQL injection using two single quotes in the login and password fields. It allows unauthorized admin access to perform actions like system backup, server restart, and stopping filters.