A vulnerability, which was classified as critical, was found in Positive H-Sphere 2.3 Rc3. Affected is an unknown code block. The manipulation of the argument mode/zipfile with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

H-Sphere WebShell 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) mode and (2) zipfile parameters in a URL request.

The weakness was published 12/31/2003 by Carl Livitt (Website). The advisory is shared for download at securityfocus.com. This vulnerability is traded as CVE-2003-1248 since 11/16/2005. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (11001), SecurityFocus (BID 6539†) and SecurityTracker (ID 1005893†). Similar entry is available at VDB-21179.

Productinfo

Vendor

• Positive

Name

• H-Sphere

Version

• 2.3 Rc3

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion