cbcvebase.
CVE-2014-6389
published 2014-10-06

CVE-2014-6389: backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter.

PriorityP265high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
8.56%
94.4th percentile
backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter.

Affected

1 ranges
VendorProductVersion rangeFixed in
phpcomptaphpcompta_noalyss<= 6.7.1—

Detection & IOCsextracted from sources · hover to see the quote

path/phpcompta/backup.php↗
filenameexploit.php↗
url/phpcompta/backup.php?sa=b&t=m&d=123;%20echo%20%22%3c%3f%70%68%70%20%70%68%70%69%6e%66%6f%28%29%3b%3f%3e%22%20>%20exploit.php↗
commandd=123;%20echo%20%22%3c%3f%70%68%70%20%70%68%70%69%6e%66%6f%28%29%3b%3f%3e%22%20>%20exploit.php↗
  • →Monitor HTTP GET requests to backup.php containing shell metacharacters (e.g., semicolons, pipes, redirects) in the 'd' parameter, which are passed unsanitized to PHP's passthru() function. ↗
  • →Alert on GET requests to /phpcompta/backup.php with query parameters sa=b&t=m and a 'd' value containing URL-encoded semicolons (%3b or ;) or redirect operators (> / %3e), indicating command injection attempts. ↗
  • →Detect creation of new PHP files (e.g., exploit.php) in the web root of the PHPCompta/NOALYSS application, which may indicate successful exploitation via shell redirection in the 'd' parameter. ↗
  • ·The vulnerability is exploitable only in PHPCompta/NOALYSS versions up to and including 6.7.1 (build 5638); version 6.7.2 contains the fix. Ensure detection rules are scoped to unpatched deployments. ↗
  • ·The attack is delivered via an authenticated or unauthenticated HTTP GET request; the PoC includes a PHPSESSID cookie, suggesting a valid session may be required. Verify whether authentication is enforced on backup.php in your deployment. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.