CVE-2017-14535 (HIGH 8.8) · Watchpost

← All vulnerabilities

CVE-2017-14535

HIGH 8.8CVE-2017-14535 · Published 16/02/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
trixbox netfortris	`= 2.8.0.4`	No fix yet

Description

trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php.

References

packetstormsecurity.com/files/162854/Trixbox-2.8.0.4-Remote-Code-Execution.html · Exploit
securityfocus.com/bid/103004 · Third Party Advisory
Hacker5preme/Exploits · Exploit
secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535 · Exploit
twitter.com/tiger_tigerboy/status/962689803270500352 · Third Party Advisory
linkedin.com/pulse/trixbox-os-command-injection-vulnerability-sachin-wagh-ceh-ecsa- · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free