CVE-2016-9554
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 25%
from disclosure to weapon0 days
Published on NVDJan 28
1st PoCDec 12
exploitation probability
25%top 2% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. These vulnerabilities occur in MgrDiagnosticTools.php (/controllers/MgrDiagnosticTools.php), in the component responsible for performing diagnostic tests with the UNIX wget utility. The application doesn't properly escape the information passed in the 'url' variable before calling the executeCommand class function ($this->dtObj->executeCommand). This function calls exec() with unsanitized user input allowing for remote command injection. The page that contains the vulnerabilities, /controllers/MgrDiagnosticTools.php, is accessed by a built-in command answered by the administrative interface. The command that calls to that vulnerable page (passed in the 'section' parameter) is: 'configuration'. Exploitation of this vulnerability yields shell access to the remote machine under the 'spiderman' user account.
Affected products
n/a · n/apublic PoCs found — 1
exploitdbwww.exploit-db.com/exploits/41414unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.