| Package | Affected versions | Patched versions |
|---|---|---|
| open-audit | = 3.3.1 |
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free