CVE-2011-2148 Command injection in n/a
Remote attackers with admin access can execute arbitrary commands on SmarterStats via OS command injection in the admin interface.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-2148?
CVE-2011-2148 is a critical command injection vulnerability in n/a, published on 20 May 2011. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involving a leading and trailing & (ampersand) character, and (1) an STTTState cookie, (2) the ctl00%24MPH%24txtAdminNewPassword_SettingText parameter, (3) the ctl00%24MPH%24txtSmarterLogDirectory parameter, (4) the ctl00%24MPH%24ucSiteSeoSearchEngineSettings%24chklistEngines_SettingCheckBox%2414 parameter, (5) the ctl00%24MPH%24ucSiteSeoSettings%24txtSeoMaxKeywords_SettingText parameter, or (6) the ctl00_MPH_grdLogLocations_HiddenLSR parameter, related to an "OS command injection" issue.
Weakness: CWE-78
Which versions are affected by CVE-2011-2148?
It affects 1 product.
Products include Smartertools Smarterstats.
How do I fix CVE-2011-2148?
No fix has been published for CVE-2011-2148 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2011-2148 being exploited?
There is no known exploitation of CVE-2011-2148 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-r6cx-xm47-5v7p.