Asbru Software Web Content Editor Shell Command Execution Vulnerability

Bugtraq ID:	20544
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 16 2006 12:00AM
Updated:	Oct 16 2006 09:14PM
Credit:	Jan Muenther of n.runs GmbH discovered this issue.
Vulnerable:	Asbru Software Asbru Web Content Management 6.0.21
Not Vulnerable:	Asbru Software Asbru Web Content Management 6.0.22

Asbru Software Web Content Editor Shell Command Execution Vulnerability

The Asbru Software Web Content Editor is prone to a vulnerability that may permit the execution of arbitrary shell commands. This issue occurs because the application fails to properly sanitize user-supplied input before using it in a process creation function call.

Exploiting this issue allows attackers to execute arbitrary shell commands with the privileges of users executing a vulnerable version of the application.

This issue affects versions prior to 6.0.22.

Asbru Software Web Content Editor Shell Command Execution Vulnerability

Attackers can exploit this issue via a browser.

Asbru Software Web Content Editor Shell Command Execution Vulnerability

Solution:
The vendor has released version 6.0.22 to address this issue.

Please see the referenced advisories for more information.

Asbru Software Web Content Editor Shell Command Execution Vulnerability

References:

• Asbru HardCore Web Content Editor Version 6.0.22 update (Asbru)
  
• Asbru Web Content Management Product Page (Asbru Web)