CVE-2016-5840 | BDVDB-2026-76712 Detail

Description#

hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.zerodayinitiative.com/advisories/ZDI-16-373
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000103.html
http://jvn.jp/en/jp/JVN55428526/index.html
https://www.exploit-db.com/exploits/40180/
http://esupport.trendmicro.com/solution/en-US/1114281.aspx

Exploit#

https://www.exploit-db.com/exploits/40180/

History#

Version 12016-06-30Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.