CVE-2005-3330 The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metach...
HighCVSS 7.5
EPSS 17.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly handled by the fetch function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| snoopy | = 1.2 | No fix listed |
References
- 20051025 SEC-Consult SA 20051025-0 :: Snoopy Remote Code Execution Vulnerability mailing-list
- 20051027 Re: [Full-disclosure] SEC-Consult SA 20051025-0 :: Snoopy Remote mailing-list
- 17330 third-party-advisory
- 17455 third-party-advisory vendor-advisory
- 17779 third-party-advisory vendor-advisory
- 17887 third-party-advisory vendor-advisory
- 117 third-party-advisory
- 1015104 vdb-entry
- sourceforge.net
- sourceforge.net
- 20316 vdb-entry
- 15213 vdb-entry
- ADV-2005-2202 vdb-entry vendor-advisory
- ADV-2005-2335 vdb-entry vendor-advisory
- ADV-2005-2727 vdb-entry vendor-advisory
- snoopy-httpsrequest-command-injection(22874) vdb-entry
- svn.ampache.org
- Debian Security Tracker CVE-2005-3330 vendor-advisory