Summary
AjaXplorer is prone to a remote command injection vulnerability and a local file disclosure vulnerability because it fails to adequately sanitize user-supplied input data.
Attackers can exploit this issue to execute arbitrary commands within the context of the affected application and to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.
Versions prior to AjaXplorer 2.6 are vulnerable.
Solution
Updates are available. Please see the references for more information.
References
Severity
Classification
-
CVSS Base Score: 5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Apache Commons Daemon 'jsvc' Information Disclosure Vulnerability
- Apache ActiveMQ Persistent Cross-Site Scripting Vulnerability
- Apache Web Server Linefeed Memory Allocation Denial Of Service Vulnerability
- Aker Secure Mail Gateway Cross-Site Scripting Vulnerability
- Allaire JRun directory browsing vulnerability