CVE-2018-9246 Command injection in n/a

Critical 9.8 Published 8 Jun 2018 Updated 5 Aug 2024

Insufficient sanitization in the Perl DBAdmin module allows attackers to execute arbitrary shell commands via specific functions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-9246?

CVE-2018-9246 is a critical command injection vulnerability in n/a, published on 8 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.

Weakness: CWE-116

Which versions are affected by CVE-2018-9246?

It affects 2 products.

Products include Ledgersmb Ledgersmb, Pgobject-Util-Dbadmin Project Pgobject-Util-Dbadmin.

How do I fix CVE-2018-9246?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2018-9246 being exploited?

There is no known exploitation of CVE-2018-9246 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2018-9246, GHSA-9f5v-36fp-5cv6, UBUNTU-CVE-2018-9246.