| Package | Affected versions | Patched versions |
|---|---|---|
| stream extension | = 2.4.29 |
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory with .dns.pid extension. Unauthenticated attackers can execute the malicious commands by making a single HTTP POST request to the vulnerable dns.php script, which triggers command execution and then deletes the file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free