CVE-2008-6534 Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands via a custom SITE command containing shell metacharacters suc...
HighCVSS 7.1
EPSS 4.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands via a custom SITE command containing shell metacharacters such as "&" (ampersand) in the middle of an argument.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vwsolutions null ftp | = 1.1.0.7-pro | No fix listed |
| vwsolutions null ftp | = 1.1.0.7-svr | No fix listed |
References
- 32999 third-party-advisory vendor-advisory
- vuln.sg
- 50486 vdb-entry
- 32656 vdb-entry
- ADV-2008-3367 vdb-entry vendor-advisory
- www.vwsolutions.com url-repurposed
- nullftpserver-site-command-execution(47099) vdb-entry
- 7355 exploit