CVE-2007-3572

Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the param parameter, as demonstrated by URL encoded "`" (backtick) characters (%60 sequences).

Link	Resource
http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0020.html	Exploit
http://www.securityfocus.com/bid/24743	Exploit
http://secunia.com/advisories/25902	Exploit Vendor Advisory
http://www.vupen.com/english/advisories/2007/2417
http://osvdb.org/37808
http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0092.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/35208

Configuration 1

cpe:2.3:a:yoggie:pico_pro:*:*:*:*:*:*:*:* cpe:2.3:a:yoggie:pico:*:*:*:*:*:*:*:*

---

Published : 2007-07-05 08:30

Updated : 2017-07-29 01:32

---

NVD link : CVE-2007-3572

Mitre link : CVE-2007-3572

No products.

CWE-78