Thomson Reuters Velocity Analytics CVE-2013-5912 Remote Code Injection Vulnerability

Bugtraq ID:	63880
Class:	Unknown
CVE:	CVE-2013-5912
Remote:	Yes
Local:	No
Published:	Nov 22 2013 12:00AM
Updated:	Nov 22 2013 12:00AM
Credit:	Eduardo Gonzalez
Vulnerable:
Not Vulnerable:

Thomson Reuters Velocity Analytics CVE-2013-5912 Remote Code Injection Vulnerability

Thomson Reuters Velocity Analytics is prone to a vulnerability that lets attackers inject and execute arbitrary code.

Successfully exploiting this issue may allow an attacker to upload and execute arbitrary code with SYSTEM privileges.

Thomson Reuters Velocity Analytics 6.94 build 2995 is vulnerable; other versions may also be affected.

Thomson Reuters Velocity Analytics CVE-2013-5912 Remote Code Injection Vulnerability

An attacker can exploit this issue using a web browser.

The following example URI is available:

http://www.example.com/VhttpdMgr?action=importFile&fileName={BACKDOOR}

Thomson Reuters Velocity Analytics CVE-2013-5912 Remote Code Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Thomson Reuters Velocity Analytics CVE-2013-5912 Remote Code Injection Vulnerability

References: