JVNDB-2009-000051

Webservice-DIC yoyaku_v41 vulnerable to command injection

yoyaku_v41 from Webservice-DIC contains a command injection vulnerability.

yoyaku_v41 from Webservice-DIC is a software to manage conference room reservations. yoyaku_v41 contains a command injection vulnerability.

Masako Oono reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Base Metrics: 7.5 (High) [IPA Score]

• Access Vector: Network
• Access Complexity: Low
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: Partial
• Availability Impact: Partial

Webservice-DIC

• yoyaku_v41 Version:1.00

An arbitrary command could be executed with the privilege of the server where yoyaku_v41 runs.

[Update the Software]
Update to the latest version according to the information provided by the developer.

Webservice-DIC

• Free CGI : yoyaku_v41 (Japanese)

1. OS Command Injection(CWE-78) [IPA Evaluation]

1. JVN : JVN#80436657

[2009/07/31]
  Web page published