Categorie: Vulnerability Posted: 2003-09-26 by ReCall Views: 367 Source: Click here
Current Rating: Not rated
Details
Description: A vulnerability was reported in MondoSearch. A remote user can execute arbitrary ASP code on the server.
PROTEGO issued a security advisory warning of a flaw in MsmSetup.exe, part of the default intallation. The advisory indicates that a remote user can exploit this flaw by sending a specially crafted query string to create files with user-supplied content on the web server with the privileges of the web server. A remote user can create an arbitrary file containing scripting code and then cause the target web server to execute the code with root level privileges.
The following notification timeline is provided:
Vendor contacted: 15-Sep-2003
Public release: 24-Sep-2003
Impact: A remote user can execute arbitrary code with the privileges of the web server process.
Solution: The vendor has issued a fix, available at:
