Netsweeper WebAdmin unixlogin.php Python Code Injection

Anandhu K A

Published on

16 Jun 2021

Vulnerability

Netsweeper offers real-time content tracking and notification for early intervention. Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.

Mitigation / Precaution

If you are affected by this CVE, you can automatically upgrade the application to the latest edition, or at the very least to 1.5.2.

Automated human-like penetration testing for your web apps & APIs

Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Product tour

Written by