Vulnérabilité CVE-2014-5091 CVE Vulnerability

A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code. (CVSS:10.0) (Last Update:2020-02-11)

Vulnerability Details : (1 public exploit) A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code. Publish Date : 2020-02-07 Last Update Date : 2020-02-11 - CVSS Scores & Vulnerability Types CVSS Score 10.0 Confidentiality Impact Complete(There is total information disclosure, resulting in all system files being revealed.) Integrity Impact Complete(There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised.) Availability Impact Complete(There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.) Access Complexity Low(Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. ) Authentication Not required(Authentication is not required to exploit the vulnerability.) Gained Access None Vulnerability Type(s) Execute Code CWE ID 20 - Products Affected By CVE-2014-5091 # Product Type Vendor Product Version Update Edition Language 1 Application Status2k Status2k * * * * Version Details Vulnerabilities - Number Of Affected Versions By Product Vendor Product Vulnerable Versions Status2k Status2k 1 - References For CVE-2014-5091 http://packetstormsecurity.com/files/127719/Status2k-XSS-SQL-Injection-Command-Execution.html https://exchange.xforce.ibmcloud.com/vulnerabilities/95111 Exploit!http://www.exploit-db.com/exploits/34239 Status2k Server Monitoring Software - Multiple Vulnerabilities Author:Shayan S Release Date:2014-08-02 (php) webappsPort:80 https://www.securityfocus.com/bid/69008

- Metasploit Modules Related To CVE-2014-5091 There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)