CVE-2020-37123

Pinger 1.0 - Remote Code Execution

CVSS 9.3 CRITICALEPSS 3.1%CWE-78

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

wcchandler · Pinger

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/48323unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/wcchandler/pinger https://www.exploit-db.com/exploits/48323 https://www.vulncheck.com/advisories/pinger-remote-code-execution