Vulnerabilities > CVE-2007-3621 - Remote Command Execution vulnerability in AsteriDex CallBoth.PHP

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
asteridex
nessus
exploit available
NVD
Published: 2007-07-09
Updated: 2018-10-15

Summary

Multiple CRLF injection vulnerabilities in callboth.php in AsteriDex 3.0 and earlier allow remote attackers to inject arbitrary shell commands via the (1) IN and (2) OUT parameters.

Vulnerable Configurations

Part Description Count
Application
Asteridex
1

Exploit-Db

descriptionAsteriDex <= 3.0 Remote (callboth.php) Remote Code Execution Exploit. CVE-2007-3621. Webapps exploit for php platform
fileexploits/php/webapps/4151.sh
idEDB-ID:4151
last seen2016-01-31
modified2007-07-05
platformphp
port
published2007-07-05
reporterCarl Livitt
sourcehttps://www.exploit-db.com/download/4151/
titleAsteriDex <= 3.0 - Remote callboth.php Remote Code Execution Exploit
typewebapps

Nessus

NASL familyCGI abuses
NASL idASTERIDEX_IN_CODE_INJECTION.NASL
descriptionThe remote host is running AsteriDex, a web-based dialer and address book for Asterisk. The version of AsteriDex installed on the remote host fails to sanitize input to the
last seen2020-06-01
modified2020-06-02
plugin id25674
published2007-07-06
reporterThis script is Copyright (C) 2007-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/25674
titleAsteriDex callboth.php Multiple Parameter CRLF Injection Arbitrary Command Execution

References