Netsweeper WebAdmin unixlogin.php Python Code Injection

By
Anandhu K A
Published on
16 Jun 2021
Vulnerability

Netsweeper offers real-time content tracking and notification for early intervention. Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.

Mitigation / Precaution

If you are affected by this CVE, you can automatically upgrade the application to the latest edition, or at the very least to 1.5.2.

Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Written by
Anandhu K A
Anandhu K A
Lead Engineer
Find website security issues in a flash
Improve your website's security posture with proactive vulnerability detection.
Free website security assessment