Exploitation Summary
EIP tracks 3 public exploits for CVE-2017-1092.
PoCs published by Metasploit, SecuriTeam, SecuriTeam, bcoles, including Metasploit module exploits/multi/http/ibm_openadmin_tool_soap_welcomeserver_exec.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated PHP code execution vulnerability in IBM OpenAdmin Tool by injecting arbitrary PHP code into the 'config.php' file via the 'new_home_page' parameter in the 'saveHomePage' SOAP method.
Description
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID: 120390.
Exploits (3)
This Metasploit module exploits an unauthenticated PHP code execution vulnerability in IBM OpenAdmin Tool by injecting arbitrary PHP code into the 'config.php' file via the 'new_home_page' parameter in the 'saveHomePage' SOAP method.
This exploit demonstrates a static PHP code injection vulnerability in IBM Informix Dynamic Server's OpenAdmin Tool (OAT) via the `welcomeService.php` SOAP interface, allowing unauthenticated remote code execution by injecting malicious PHP code into `config.php`. The PoC sends a crafted SOAP request to inject a system command execution payload, then triggers it via a GET request.
This Metasploit module exploits an unauthenticated PHP code execution vulnerability in IBM OpenAdmin Tool by injecting arbitrary PHP code into the 'config.php' file via the 'new_home_page' parameter in the SOAP 'saveHomePage' method.
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H