Description
An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a crafted HTTP POST request, resulting in arbitrary command execution on the underlying system with web server privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eppler Software | WebTester | 5.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
WebTester 5.x Command Execution
exploit/unix/webapp/webtester_exec
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/webtester_exec.rb exploit
- https://sourceforge.net/p/webtesteronline/bugs/3/ issue-tracking
- https://www.exploit-db.com/exploits/29132 exploit
- https://advisories.checkpoint.com/defense/advisories/public/2014/cpai-2014-1620.html third-party-advisory
- https://www.vulncheck.com/advisories/webtester-unauth-command-execution third-party-advisory