Numara FootPrints 'MRchat.pl' and 'MRABLoad2.pl' Multiple Remote Command Execution Vulnerabilities

Bugtraq ID:	27373
Class:	Input Validation Error
CVE:	CVE-2008-7158
Remote:	Yes
Local:	No
Published:	Jan 21 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	Ricky Zhou is credited with the discovery of these issues.
Vulnerable:	Numara FootPrints 8.0 Numara FootPrints 7.5a1 Numara FootPrints 7.5a
Not Vulnerable:	Numara FootPrints 8.1

Numara FootPrints 'MRchat.pl' and 'MRABLoad2.pl' Multiple Remote Command Execution Vulnerabilities

Numara FootPrints is prone to multiple vulnerabilities that attackers can leverage to execute arbitrary commands. These issues occur because the application fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected application and possibly the underlying computer.

Versions prior to FootPrints 8.1 are vulnerable.

Numara FootPrints 'MRchat.pl' and 'MRABLoad2.pl' Multiple Remote Command Execution Vulnerabilities

Currently we are not aware of any working exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Numara FootPrints 'MRchat.pl' and 'MRABLoad2.pl' Multiple Remote Command Execution Vulnerabilities

Solution:
The vendor has released FootPrints 8.1 as well as patches to address these issues. Please see the references for more information.

Numara FootPrints 'MRchat.pl' and 'MRABLoad2.pl' Multiple Remote Command Execution Vulnerabilities

References:

• Numara Homepage (Numara)
  
• security update for Footprints versions 7.5a through 7.5a1 (Numara)