Vulnerability Details : CVE-2011-5274
The drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter in a do_install action to dtc/.
Exploit prediction scoring system (EPSS) score for CVE-2011-5274
Probability of exploitation activity in the next 30 days: 0.20%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 56 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2011-5274
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2011-5274
-
http://www.debian.org/security/2011/dsa-2365
Debian -- Security Information -- DSA-2365-1 dtc
-
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637630
#637630 - shell injection in package installer - Debian Bug report logs
- http://git.gplhost.com/gitweb/?p=dtc.git;a=blob;f=debian/changelog;h=dec9970db76b82295e9003ca34cecab8d629da4f;hb=65a7a1b166ea3c4325efd4da80a78498c829aa5a
- http://git.gplhost.com/gitweb/?p=dtc.git;a=commitdiff;h=541d8457a6989a1a925bb866ed972a5f07c2de64
Products affected by CVE-2011-5274
- cpe:2.3:a:gplhost:domain_technologie_control:*:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.27.3:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.26.9:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.1:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.10:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.3:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.2:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.26.8:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.26.7:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.9:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.6:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.30.6:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.30.8:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.25.2:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.25.3:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.16:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.4:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.25.1:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.30.10:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.30.18:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.17:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.15:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.14:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.24.6:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.5:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.30.20:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.1:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.8:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.10:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.6:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.4:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.6:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.2:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.3:*:*:*:*:*:*:*