Remote Code Execution Vulnerability in NetGain Systems Enterprise Manager

CVE-2017-17407

What is CVE-2017-17407?

A vulnerability in NetGain Systems Enterprise Manager allows remote attackers to execute arbitrary code on affected installations without the need for authentication. The issue arises from improper handling of the content parameter within the script_test.jsp endpoint, where a specially crafted request can trigger the execution of system calls built from user-supplied strings. Successful exploitation enables attackers to run malicious code in the context of the web service, posing a significant threat to the integrity and security of the affected system.

References