Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2001-1130 — Linux vulnerability

4 documents4 sources

Severity

7.5HIGHNVD

EPSS

4.4%

top 10.97%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Suse Linux

Timeline

PublishedAug 2

Latest updateApr 30

Description

Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames with shell metacharacters, then causing the file to be searched using a .. in the HTTP referer (from the HTTP_REFERER variable) to point to the directory that contains the keylist.txt file.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDsuse/suse_linux6 versions+5

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

GHSA

GHSA-cr34-rcr6-jr32: Sdbsearch↗2022-04-30

▶

CVEList

CVE-2001-1130: Sdbsearch↗2002-06-25

▶

💥Exploits & PoCs

Exploit-DB

SuSE 6.3/6.4/7.0 sdb - Arbitrary Command Execution↗2001-08-02

▶