An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html | mitigation exploit vdb entry third party advisory |
| https://www.exploit-db.com/exploits/46527/ | exploit vdb entry third party advisory |
| http://www.securityfocus.com/archive/1/542103/100/0/threaded | mailing list vdb entry third party advisory broken link |
| http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html | exploit vdb entry third party advisory |