SKIDATA Freemotion.Gate Unauthenticated Web Services Multiple Command Execution Vulnerabilities
BID:63805
Info
SKIDATA Freemotion.Gate Unauthenticated Web Services Multiple Command Execution Vulnerabilities
| Bugtraq ID: | 63805 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 19 2013 12:00AM |
| Updated: | Nov 19 2013 12:00AM |
| Credit: | Dennis Kelly |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
SKIDATA Freemotion.Gate Unauthenticated Web Services Multiple Command Execution Vulnerabilities
SKIDATA Freemotion.Gate is prone to multiple remote command-execution vulnerabilities.
Attackers can exploit these issues to execute arbitrary commands in the context of the affected system.
SKIDATA Freemotion.Gate 4.1.3.5 is vulnerable; other versions may also be affected.
SKIDATA Freemotion.Gate is prone to multiple remote command-execution vulnerabilities.
Attackers can exploit these issues to execute arbitrary commands in the context of the affected system.
SKIDATA Freemotion.Gate 4.1.3.5 is vulnerable; other versions may also be affected.
Exploit / POC
SKIDATA Freemotion.Gate Unauthenticated Web Services Multiple Command Execution Vulnerabilities
The following example request is available:
curl -X POST --header "Content-Type:text/xml" --data-binary @manual-release.raw http://www.example.com:7777/skidata/hessian/CP > /dev/null 2>&1
The following example request is available:
curl -X POST --header "Content-Type:text/xml" --data-binary @manual-release.raw http://www.example.com:7777/skidata/hessian/CP > /dev/null 2>&1
Solution / Fix
SKIDATA Freemotion.Gate Unauthenticated Web Services Multiple Command Execution Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].