Description (CNA)
The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ICT Innovations / ICTBroadcast | affected 0 through 7.4 |
CWE
CWE-78
References
- https://github.com/rapid7/metasploit-framework/pull/20446
- https://www.vulncheck.com/blog/ictbroadcast-kev
- https://www.vulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce
ADP enrichment
No English description supplied.
No references supplied.