Description
A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the server via embedded base64-encoded payloads. Authentication may be required depending on deployment configuration.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
GestioIP IPAM
Default version status: unaffected
0 to < 3.0 commit ac67beaffected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/gestioip_exec.rb ↗
- https://sourceforge.net/p/gestioip/gestioip/ci/ac67be9fce5ee4c0438d27dfa5c1dcbca08c457c/ ↗
- https://sourceforge.net/projects/gestioip/ ↗
- https://www.vulncheck.com/advisories/gestioip-rce ↗