CVE-2011-10017

Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and can result in full compromise of the underlying system.

CVSS

No CVSS.

References

Link	Resource
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/snortreport_exec.rb
https://web.archive.org/web/20111003093911/http://www.symmetrixtech.com/articles/news-016.html
https://www.exploit-db.com/exploits/17947
https://www.vulncheck.com/advisories/snort-report-rce

Configurations

No configuration.

History

14 Aug 2025, 13:11

Type	Values Removed	Values Added
Summary		(es) Las versiones de Snort Report anteriores a la 1.3.2 contienen una vulnerabilidad de ejecución remota de comandos en los scripts nmap.php y nbtscan.php. Estos scripts no depuran correctamente la entrada del usuario enviada mediante el parámetro GET del objetivo, lo que permite a los atacantes inyectar comandos de shell arbitrarios. Su explotación no requiere autenticación y puede comprometer por completo el sistema subyacente.

13 Aug 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-13 21:15

Updated : 2025-08-14 13:11

NVD link : CVE-2011-10017

Mitre link : CVE-2011-10017

CVE.ORG link : CVE-2011-10017

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2011-10017", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "disclosure@vulncheck.com"}], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-13T21:15:29.233", "references": [{"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/snortreport_exec.rb", "source": "disclosure@vulncheck.com"}, {"url": "https://web.archive.org/web/20111003093911/http://www.symmetrixtech.com/articles/news-016.html", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/17947", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/snort-report-rce", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and can result in full compromise of the underlying system."}, {"lang": "es", "value": "Las versiones de Snort Report anteriores a la 1.3.2 contienen una vulnerabilidad de ejecuci\u00f3n remota de comandos en los scripts nmap.php y nbtscan.php. Estos scripts no depuran correctamente la entrada del usuario enviada mediante el par\u00e1metro GET del objetivo, lo que permite a los atacantes inyectar comandos de shell arbitrarios. Su explotaci\u00f3n no requiere autenticaci\u00f3n y puede comprometer por completo el sistema subyacente."}], "lastModified": "2025-08-14T13:11:53.633", "sourceIdentifier": "disclosure@vulncheck.com"}