Detections
Analytics
CGI Generic Command Execution
high Nessus Plugin ID 39465
Language:
Synopsis
Arbitrary code may be run on the remote server.Description
The remote web server hosts CGI scripts that fail to adequately sanitize request strings. By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host.Solution
Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade to address command execution flaws.See Also
https://en.wikipedia.org/wiki/Code_injection
http://projects.webappsec.org/w/page/13246950/OS%20Commanding
Plugin Details
Severity: High
ID: 39465
File Name: torture_cgi_command_exec.nasl
Version: 1.40
Type: remote
Family: CGI abuses
Published: 6/19/2009
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
Required KB Items: Settings/enable_web_app_tests