GreyMatter WebLog Remote Command Execution Vulnerability

Bugtraq ID:	7055
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 10 2003 12:00AM
Updated:	Mar 10 2003 12:00AM
Credit:	Discovery credited to Naz <[email protected]>.
Vulnerable:	Noah Grey Greymatter 1.21 d Noah Grey Greymatter 1.21 c Noah Grey Greymatter 1.21 b Noah Grey Greymatter 1.21 a Noah Grey Greymatter 1.21 Noah Grey Greymatter 1.2 Noah Grey Greymatter 1.1 b
Not Vulnerable:

GreyMatter WebLog Remote Command Execution Vulnerability

It has been reported that a problem in GreyMatter weblog may allow unauthorized access to systems. Due to improper sanitization of untrusted input, it may be possible for a remote user to execute commands on the local system.

GreyMatter WebLog Remote Command Execution Vulnerability

Solution:
It has been reported that this issue was meant to be resolved in the 1.21d version of the GreyMatter software. This release failed to sufficiently address the issue however.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

GreyMatter WebLog Remote Command Execution Vulnerability

References:

• Greymatter Product Homepage (Noah Grey)
  
• Greymatter v1.21d: Remote PHP command injection/execution. ("FraMe" )