CVE-2017-9757

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/99173Third Party Advisory, VDB Entry
https://twitter.com/0x09AL/status/873860385652256768Third Party Advisory
https://www.exploit-db.com/exploits/42149/Exploit, Third Party Advisory
http://www.securityfocus.com/bid/99173Third Party Advisory, VDB Entry
https://twitter.com/0x09AL/status/873860385652256768Third Party Advisory
https://www.exploit-db.com/exploits/42149/Exploit, Third Party Advisory

Timeline

Published: Jun 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-97587.4Savitech driver packages for Windows silently install a self-signed certificate into the Trusted Root Certification Authorities store, aka "CVE-2017-97598.8SQL Injection exists in admin/index.php in Zenbership 1.0.8 via the filters array parameter, exploitable by a privileged account.CVE-2017-97615.5The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds rea CVE-2017-97625.5The cmd_info function in libr/core/cmd_info.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and appl CVE-2017-97637.5The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote CVE-2017-97646.1Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP CVE-2017-97658.1Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows CVE-2017-97667.5In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in CVE-2017-97675.4Multiple cross-site scripting (XSS) vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inject arbitrary web sc CVE-2017-97699.8A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a CVE-2017-97705.5A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse that can cause an out of bounds read operation to occur due CVE-2017-97719.8install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or