RETIRED: 4images 'command' Parameter Remote Command Execution Vulnerability

Bugtraq ID:	41974
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 19 2010 12:00AM
Updated:	Jul 27 2010 03:55PM
Credit:	ViRuS Qalaa
Vulnerable:	4homepages 4images 1.7.7
Not Vulnerable:

RETIRED: 4images 'command' Parameter Remote Command Execution Vulnerability

4images is prone to a remote command-execution vulnerability because the software fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected software and the underlying server.

4images version 1.7.7 is affected; other versions may also be vulnerable.

RETIRED: This BID is retired; this issue is not exploitable as described.

RETIRED: 4images 'command' Parameter Remote Command Execution Vulnerability

An attacker can exploit this issue using a browser.

The following example URI is available:

http://www.example.com/{path}/includes/image_utils.php?command=ls -la

RETIRED: 4images 'command' Parameter Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: 4images 'command' Parameter Remote Command Execution Vulnerability

References:

• 4images Download page (4homepages)