CWE Code: 94
Vulnerability Type: privilege_escalation
CVSS Score: 7.1
CWE Name:  Improper Control of Generation of Code ('Code Injection')
Summary: xcloner standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php.  note: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code.  note: this can be leveraged by remote attackers using cve-2014-2579.
Access Authentication: SINGLE
Access Complexity: HIGH
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2014-04-25
Last Modified Date: 2018-10-09