Vulnerability Details : CVE-2017-1092
Public exploit exists!
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID: 120390.
Vulnerability category: Execute code
Products affected by CVE-2017-1092
- cpe:2.3:a:ibm:informix_open_admin_tool:12.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:informix_open_admin_tool:11.7:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:informix_open_admin_tool:11.5:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-1092
96.63%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2017-1092
-
IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution
Disclosure Date: 2017-05-30First seen: 2020-04-26exploit/multi/http/ibm_openadmin_tool_soap_welcomeserver_execThis module exploits an unauthenticated remote PHP code execution vulnerability in IBM OpenAdmin Tool included with IBM Informix versions 11.5, 11.7, and 12.1. The 'welcomeServer' SOAP service does not properly validate user input in the 'new_home_page' para
CVSS scores for CVE-2017-1092
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
References for CVE-2017-1092
-
https://www.exploit-db.com/exploits/42091/
IBM Informix Dynamic Server / Informix Open Admin Tool - DLL Injection / Remote Code Execution / Heap Buffer Overflow
-
https://www.exploit-db.com/exploits/42541/
IBM OpenAdmin Tool - SOAP welcomeServer PHP Code Execution (Metasploit)
-
http://www.ibm.com/support/docview.wss?uid=swg22002897
IBM Security Bulletin: Vulnerabilities in Informix Dynamic Server and Informix Open Admin ToolPatch;Vendor Advisory
Jump to