CVE-2007-0849

scripts/cronscript.php in SysCP 1.2.15 and earlier does not properly quote pathnames in user home directories, which allows local users to gain privileges by placing shell metacharacters in a directory name, and then using the control panel to protect this directory, a different vulnerability than CVE-2005-2568.

Link	Resource
http://www.securityfocus.com/bid/22453	Exploit Patch
http://secunia.com/advisories/24102
http://www.syscp.org/wiki/Security/SyscpOrgAbilityToInjectAndExecuteAnyCodeAsRootInSysCP
http://osvdb.org/33128
http://www.securityfocus.com/archive/1/459397/100/0/threaded

Configuration 1

cpe:2.3:a:syscp_team:syscp:*:*:*:*:*:*:*:*

---

Published : 2007-02-08 06:28

Updated : 2018-10-16 04:34

---

NVD link : CVE-2007-0849

Mitre link : CVE-2007-0849

No products.

NVD-CWE-Other