CVE-2016-9554

EIP tracks 1 public exploit for CVE-2016-9554. PoCs published by xort.

AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Sophos Web Appliance <= v4.2.1.3 via the diagnostic_tools wget functionality. It authenticates, injects commands via URL-encoded payloads, and either executes arbitrary commands or deploys an ELF payload for a reverse shell.

The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. These vulnerabilities occur in MgrDiagnosticTools.php (/controllers/MgrDiagnosticTools.php), in the component responsible for performing diagnostic tests with the UNIX wget utility. The application doesn't properly escape the information passed in the 'url' variable before calling the executeCommand class function ($this->dtObj->executeCommand). This function calls exec() with unsanitized user input allowing for remote command injection. The page that contains the vulnerabilities, /controllers/MgrDiagnosticTools.php, is accessed by a built-in command answered by the administrative interface. The command that calls to that vulnerable page (passed in the 'section' parameter) is: 'configuration'. Exploitation of this vulnerability yields shell access to the remote machine under the 'spiderman' user account.