CVE-2005-3330
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 17%
from disclosure to weapon0 days
Published on NVDOct 27
1st PoCOct 26
exploitation probability
17%top 3% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly handled by the fetch function.
Affected products
n/a · n/apublic PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/26424⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://marc.info/?l=bugtraq&m=113028858316430&w=2http://marc.info/?l=bugtraq&m=113062897231412&w=2http://secunia.com/advisories/17330http://secunia.com/advisories/17455http://secunia.com/advisories/17779http://secunia.com/advisories/17887http://securityreason.com/securityalert/117http://securitytracker.com/id?1015104https://exchange.xforce.ibmcloud.com/vulnerabilities/22874http://sourceforge.net/project/shownotes.php?release_id=368750http://sourceforge.net/project/shownotes.php?release_id=375385https://svn.ampache.org/branches/3.3.1/docs/CHANGELOG