Search for vulnerabilities
| Vulnerability ID | VCID-h477-94bs-aaaj |
| Aliases |
CVE-2012-6329
|
| Summary | The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 6.8 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Data source | Exploit-DB |
|---|---|
| Date added | Dec. 23, 2012 |
| Description | TWiki MAKETEXT - Remote Command Execution (Metasploit) |
| Ransomware campaign use | Known |
| Source publication date | Dec. 23, 2012 |
| Exploit type | remote |
| Platform | unix |
| Source update date | Dec. 23, 2012 |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a vulnerability in the MAKETEXT Twiki variable. By using a specially crafted MAKETEXT, a malicious user can execute shell commands since user input is passed to the Perl "eval" command without first being sanitized. The problem is caused by an underlying security issue in the CPAN:Locale::Maketext module. This works in TWiki sites that have user interface localization enabled (UserInterfaceInternationalisation variable set). If USERNAME and PASSWORD aren't provided, anonymous access will be tried. Also, if the 'TwikiPage' option isn't provided, the module will try to create a random page on the SandBox space. The module has been tested successfully on TWiki 5.1.2 as distributed with the official TWiki-VM-5.1.2-1 virtual machine. |
| Note | {}
|
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 15, 2012 |
| Platform | Unix |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/unix/webapp/twiki_maketext.rb |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Percentile | 0.97808 |
| EPSS Score | 0.58020 |
| Published At | Nov. 1, 2024, midnight |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| There are no relevant records. | ||||