OpenNetAdmin is prone to a remote PHP code-execution vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system other attacks are also possible. Impact Level: Application

Ask the Vendor for an update.

This problem exist because adding modules can be done without any sort of authentication.

OpenNetAdmin 13.03.01 is vulnerable other versions may also be affected.

This NVT add a new module to execute some php code by sending some HTTP requests to the target.

• http://www.securityfocus.com/bid/61004

---

Updated on 2015-03-25