CVE-2022-50789

Description

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory with .dns.pid extension. Unauthenticated attackers can execute the malicious commands by making a single HTTP POST request to the vulnerable dns.php script, which triggers command execution and then deletes the file.

Weakness classification

• disclosure@vulncheck.com: CWE-78

Primary references

• disclosure@vulncheck.com — Third Party Advisory
• disclosure@vulncheck.com — Exploit, Third Party Advisory, VDB Entry
• disclosure@vulncheck.com — Product
• disclosure@vulncheck.com — Third Party Advisory
• disclosure@vulncheck.com — Exploit, Third Party Advisory