Here's the page we think you wanted. See search results instead:

LAquis SCADA PAGINA TITULO HTTP Parameter Command Injection

Strike ID:
E19-5oj41
CVSS:
8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
False Positive:
f
Variants:
2
Year:
2018

Description

This strike exploits a command injection vulnerability in LAquis SCADA. The PAGINA parameter in HTTP requests to acompanhamentotela.lhtml and the TITULO parameter in requests to relatorioindividual.lhtml are not sanatized for command injection characters. An attacker can send a specially crafted HTTP GET or POST request to achieve command execution on the target machine.

CVE

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18992

Metasploit

http://www.zerodayinitiative.com/advisories/ZDI-19-061

Zdi

19-061

Bid