An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html | third party advisory exploit vdb entry mitigation |
| https://www.exploit-db.com/exploits/46527/ | third party advisory exploit vdb entry |
| http://www.securityfocus.com/archive/1/542103/100/0/threaded | third party advisory broken link vdb entry mailing list |
| http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html | third party advisory exploit vdb entry |