by Kastro
Paper/Archive/CVE-2020-37123

CVE-2020-37123

wcchandler Pinger — Pinger 1.0 - Remote Code Execution

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.8.888 × 2017.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.

Affected

ProductAffectedFixed inSource
Pinger1.0–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/48323refgithub.com/wcchandler/pingerwriteupvulncheck.com/advisories/pinger-remote-code-execution