Netquery Host Parameter Arbitrary Command Execution Vulnerability

Bugtraq ID:	14637
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 23 2005 12:00AM
Updated:	Aug 23 2005 12:00AM
Credit:	Discovery is credited to rgod <[email protected]>.
Vulnerable:	Netquery Netquery 3.11
Not Vulnerable:

Netquery Host Parameter Arbitrary Command Execution Vulnerability

Netquery is affected a remote command execution vulnerability.

An attacker can supply arbitrary commands through the 'host' parameter of the 'nquser.php' script. This can allow an attacker to execute commands in the context of an affected server and potentially gain unauthorized access.

Netquery 3.11 is affected by this vulnerability. It is possible that prior versions are vulnerable as well.

Netquery Host Parameter Arbitrary Command Execution Vulnerability

An exploit is not required.

Netquery Host Parameter Arbitrary Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Netquery Host Parameter Arbitrary Command Execution Vulnerability

References:

• Netquery Product Page (Netquery)