CVEvulnerability

CVE-2018-9246

9.8 CRITICAL Published 2018-06-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-06-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-116

Description

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.

Affected configurations

• pgobject-util-dbadmin project pgobject-util-dbadmin (< 0.120.0) • ledgersmb ledgersmb (>= 1.5.0 <= 1.5.21)

Related

Weakness · CWE (1)

  • CWE-116 Improper Encoding or Escaping of Output weakness

References