TalkBack Security Bypass and Remote Command Execution Vulnerability

Bugtraq ID:	35619
Class:	Unknown
CVE:	CVE-2009-4854
Remote:	Yes
Local:	No
Published:	Jul 09 2009 12:00AM
Updated:	Apr 13 2015 09:09PM
Credit:	jiko
Vulnerable:	TalkBack TalkBack 2.3.14
Not Vulnerable:

TalkBack Security Bypass and Remote Command Execution Vulnerability

TalkBack is prone to a security-bypass vulnerability and a remote command-execution vulnerability.

Successful exploits may allow attackers to perform unauthorized actions or execute arbitrary commands. This may aid in further attacks.

TalkBack 2.3.14 is vulnerable; other versions may also be affected.

TalkBack Security Bypass and Remote Command Execution Vulnerability

Attackers can exploit these issues via a browser.

The following example URIs are available:

http://www.example.com/talkback/comments.php?edit=1&edit_id=2&

http://www.example.com/talkback/addons/import.php?result=[Command]

TalkBack Security Bypass and Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TalkBack Security Bypass and Remote Command Execution Vulnerability

References:

• TalkBack Homepage (TalkBack)