Vulmon
The official exploit for Open-AudIT v3.3.1 Remote Code Execution CVE-2020-12078
CVE-2020-12078 The official exploit for Open-AudIT v331 Remote Code Execution CVE-2020-12078
An issue exists in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
opmantek open-audit 3.3.1 |