HTTP: Opmantek Open-AudIT discoveries_helper.php Command Injection

This signature detects attempts to exploit a known vulnerability against Opmantek Open-AudIT. A successful attack can lead to command injection and arbitrary code execution.

Extended Description

An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.

Affected Products

Opmantek open-audit

References

CVE: CVE-2020-12078

Short Name

HTTP:CTS:OPMNTK-DSCVHLP-CMD-INJ

Severity

Critical

Recommended

False

Recommended Action

Drop

HTTP: Opmantek Open-AudIT discoveries_helper.php Command Injection

Extended Description

Affected Products

References

Found a potential security threat?