WSTG-V42-INPV-12 on ZAP

Remote Code Execution - CVE-2012-1823

Mon, 01 Jan 0001 00:00:00 +0000

Some PHP versions, when configured to run using CGI, do not correctly handle query strings that lack an unescaped “=” character, enabling arbitrary code execution. In this case, an operating system command was caused to be executed on the web server, and the results were returned to the web browser.

Remote Code Execution - Shell Shock

Mon, 01 Jan 0001 00:00:00 +0000

The server is running a version of the Bash shell that allows remote attackers to execute arbitrary code.

Remote Code Execution - Shell Shock

Mon, 01 Jan 0001 00:00:00 +0000

The server is running a version of the Bash shell that allows remote attackers to execute arbitrary code.

Remote OS Command Injection

Mon, 01 Jan 0001 00:00:00 +0000

Attack technique used for unauthorized execution of operating system commands. This attack is possible when an application accepts untrusted input to build operating system commands in an insecure manner involving improper data sanitization, and/or improper calling of external programs.

Remote OS Command Injection (Time Based)

Mon, 01 Jan 0001 00:00:00 +0000

Spring4Shell

Mon, 01 Jan 0001 00:00:00 +0000

The application appears to be vulnerable to CVE-2022-22965 (otherwise known as Spring4Shell) - remote code execution (RCE) via data binding.