CVE-2008-4796 The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other pr...
HighCVSS 10.0
EPSS 9.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| snoopy project snoopy | <= 1.2.3 | No fix listed |
| debian linux | = 4.0 | No fix listed |
| debian linux | = 5.0 | No fix listed |
| nagios | < 4.2.2 | 4.2.2 |
| WordPress | < 2.6.3 | 2.6.3 |
| debian/libphp-snoopy(Debian:12) | < 1.2.4-1 | 1.2.4-1 |
| debian/wordpress(Debian:12) | < 2.5.1-9 | 2.5.1-9 |
| debian/wordpress(Debian:13) | < 2.5.1-9 | 2.5.1-9 |
| debian/wordpress(Debian:14) | < 2.5.1-9 | 2.5.1-9 |
References
- JVN#20502807 third-party-advisory vdb-entry
- JVNDB-2008-000074 third-party-advisory vdb-entry
- 32361 third-party-advisory
- sourceforge.net broken-link patch third-party-advisory
- DSA-1691 third-party-advisory vendor-advisory
- DSA-1871 third-party-advisory vendor-advisory
- [oss-security] 20081101 CVE-2008-4796: snoopy triage mailing-list third-party-advisory
- 20080907 xoops-1.3.10 shell command execute vulnerability ( causing snoopy class ) mailing-list third-party-advisory vdb-entry
- 31887 patch third-party-advisory vdb-entry
- ADV-2008-2901 third-party-advisory vdb-entry
- snoopy-snoopyclass-command-execution(46068) third-party-advisory vdb-entry
- GLSA-201702-26 third-party-advisory vendor-advisory
- www.nagios.org third-party-advisory
- Debian Security Tracker CVE-2008-4796 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking