Description
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 2.5.1-9 | — |
| Debian 13 | wordpress | 2.5.1-9 | — |
| Debian 12 | libphp-snoopy | 1.2.4-1 | — |
| Debian 12 | wordpress | 2.5.1-9 | — |
| Debian 5.0 | wordpress | 2.5.1-11+lenny1 | DSA-1871-1 |
| Debian 4.0 | moodle | 1.6.3-2+etch1 | DSA-1691-1 |
| Debian 4.0 | wordpress | 2.0.10-1etch4 | DSA-1871-2, DSA-1871-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nagios | 4.4.6-2.5 | openSUSE-SU-2024:11073-1 |
Advisories 4
- DSA-1871-2 wordpress - regression fix Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1871-1 wordpress - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1691-1 moodle - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11073-1 nagios-4.4.6-2.5 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- snoopy-snoopyclass-command-execution(46068) vdb-entry
- [oss-security] 20081101 CVE-2008-4796: snoopy triage mailing-list
- ADV-2008-2901 vdb-entry
- 20080907 xoops-1.3.10 shell command execute vulnerability ( causing snoopy class ) mailing-list
- 31887 vdb-entry
- DSA-1871 vendor-advisory
- JVN#20502807 third-party-advisory
- http://sourceforge.net/forum/forum.php?forum_id=879959
- https://www.nagios.org/projects/nagios-core/history/4x/
- GLSA-201702-26 vendor-advisory
- DSA-1691 vendor-advisory
- JVNDB-2008-000074 third-party-advisory
- 32361 third-party-advisory