CVE-2017-7280

Critical

Published: 12/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before version 9.0.0. User input is not properly filtered before being sent to a popen function, allowing for remote code execution.

Risk Assessment

This vulnerability poses a serious risk to organizations as it allows attackers to execute arbitrary code on the server, potentially leading to data loss or system takeover.

Recommendation

It is recommended to update Unitrends Enterprise Backup to version 9.0.0 or later to mitigate this vulnerability. Additionally, implementing input filtering mechanisms in the application is advisable.

Original NVD description (English source)

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable.