Description
The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://archive.ledgersmb.org/ledger-smb-announce/msg00280.html
Scores
CVSS v3
9.8
EPSS
0.0258
EPSS Percentile
83.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-116
Status
published
Products (2)
ledgersmb/ledgersmb
1.5.0 - 1.5.21
pgobject-util-dbadmin_project/pgobject-util-dbadmin
< 0.120.0
Published
Jun 08, 2018
Tracked Since
Feb 18, 2026