CVE-2017-6526
CriticalSummary
An issue was discovered in dnaTools dnaLIMS 4-2015s13 related to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi in POST requests).
Risk Assessment
The organization may be exposed to unauthorized access to the system, potentially leading to serious security breaches.
Recommendation
It is recommended to secure the administrative interface and implement appropriate authorization mechanisms for all requests to cgi-bin/dna/sysAdmin.cgi.
Other vulnerabilities in dnaTools dnaLIMS 4-2015s13
See all- CVE-2017-6529High
An issue was discovered in dnaTools dnaLIMS version 4-2015s13 related to session hijacking by guessing the UID parameter.
- CVE-2017-6528High
An issue was discovered in dnaTools dnaLIMS 4-2015s13 related to plaintext password storage. The /home/dna/spool/.pfile file contains passwords in plain text.
- CVE-2017-6527High
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user.
Original NVD description (English source)
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests).