CVE:CVE-2008-4318
CNNVD:CNNVD-200809-407
Project Observer是一个基于PHP/MySQL/SNMP/CDP的网络管理系统。
Observer 0.3.2.1 及其早期版本允许远程攻击者通过对(1) whois.php 或 (2) netcmd.php的查询参数中的SHELL元字符，以执行任意指令。
solution:Upgrade project-observer observer to a higher version than 0.3.2.1,0.1.0,0.1.1,0.1.2,0.2.0,0.2.1,0.2.2,0.2.3,0.2.4,0.2.5,0.3.1,0.3.2,0.30-pre-1,and avoid the version (,0.3.2.1],0.1.0,0.1.1,0.1.2,0.2.0,0.2.1,0.2.2,0.2.3,0.2.4,0.2.5,0.3.1,0.3.2,0.30-pre-1