← back
CVE-2016-6255

CVE-2016-6255

EPSS 26.8%
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencewww.exploit-db.com/exploits/40589/unverifiedexploitdbwww.exploit-db.com/exploits/40589unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/mjg59/pupnp-code/commit/be0a01bdb83395d9f3a5ea09c1308a4f1a972cbdhttps://security.gentoo.org/glsa/201701-52https://sourceforge.net/p/pupnp/code/ci/master/tree/ChangeLoghttps://twitter.com/mjg59/status/755062278513319936https://www.exploit-db.com/exploits/40589/https://www.tenable.com/security/research/tra-2017-10http://www.debian.org/security/2016/dsa-3736http://www.openwall.com/lists/oss-security/2016/07/18/13http://www.openwall.com/lists/oss-security/2016/07/20/5http://www.securityfocus.com/bid/92050