CVE-2016-11017
The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS commands via shell metacharacters in the username parameter (a failed login attempt returns the command-injection output to a limited login failure field). This is fixed in 16.6.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Modified - cve@mitre.org
- Published
- 2020-01-06
- Last modified
- 2024-08-06
- Weaknesses
- CWE-78
Affected products
References
- https://ctrlu.net/vuln/0002.html
- https://www.exploit-db.com/exploits/39564
