Detections
Analytics
CGI Generic Command Execution (time-based)
high Nessus Plugin ID 44967
Language:
Synopsis
It may be possible to run arbitrary code on the remote web server.Description
The remote web server hosts CGI scripts that fail to adequately sanitize request strings. By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host.Note that this script uses a time-based detection method which is less reliable than the basic method.
Solution
Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade.See Also
Plugin Details
Severity: High
ID: 44967
File Name: torture_cgi_command_exec2.nasl
Version: 1.23
Type: remote
Family: CGI abuses
Published: 2/19/2010
Updated: 4/11/2023
Supported Sensors: Nessus
Risk Information
CVSS Score Rationale: Tenable score for arbitrary command exececution vulnerabilty
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: manual
Vulnerability Information
Required KB Items: Settings/enable_web_app_tests