CVE Feed

    Dashboard / CVE / CVE-2018-9246

    CVE-2018-9246

    The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.

    Published:Jun 8, 2018
    Last Modified:Nov 21, 2024
    EPS:Jun 8, 2018
    EPSS Score:0.01022
    CVSS Score:9.8

    Affected Products

    Vendor
    Ledgersmb
    Product
    Ledgersmb
    Vendor
    Pgobject-util-dbadmin Project
    Product
    Pgobject-util-dbadmin

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-23831 (CVSS 7.5) — LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an a…
    CVE-2021-3882 (CVSS 6.8) — LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS a…
    CVE-2021-3731 (CVSS 5.9) — LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjack…
    CVE-2021-3694 (CVSS 8.2) — LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted…
    CVE-2021-3693 (CVSS 8.8) — LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially cr…
    CVE-2008-4077 (CVSS 7.8) — The CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allow remote attac…
    CVE-2008-4078 (CVSS 6.5) — SQL injection vulnerability in the AR/AP transaction report in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-…
    CVE-2007-5372 (CVSS 10) — Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x…
    CVE-2007-3907 (CVSS 10) — Unspecified vulnerability in login.pl in LedgerSMB 1.2.0 through 1.2.6 allows remote attackers to bypass authe…
    CVE-2007-1923 (CVSS 7.5) — (1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High