CVE  通用漏洞与披露Common Vulnerabilities and Exposures

- CVSS (基础分值)

CVSS分值:	7.5	[严重(HIGH)]
机密性影响:	PARTIAL	[很可能造成信息泄露]
完整性影响:	PARTIAL	[可能会导致系统文件被修改]
可用性影响:	PARTIAL	[可能会导致性能下降或中断资源访问]
攻击复杂度:	LOW	[漏洞利用没有访问限制 ]
攻击向量:		[--]
身份认证:	NONE	[漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2183 (官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-2183 (官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200412-1103 (官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/11431 (PATCH)  BID  11431

http://sourceforge.net/project/shownotes.php?release_id=275295 (UNKNOWN)  CONFIRM  http://sourceforge.net/project/shownotes.php?release_id=275295

- 漏洞信息

漏洞名称:WeHelpBUS远程命令执行漏洞
紧急程度:高危	漏洞类型:输入验证
发布日期:2004-12-31 00:00:00	更新日期:2005-10-20 00:00:00
攻击路径:远程
详细介绍:
WeHelpBUS 0.1存在未知漏洞。远程攻击者可以借助查询字符串执行任意shell命令。

- 公告与补丁

The vendor has released an update to address this vulnerability:         WeHelpBUS WeHelpBUS 0.1                  WeHelpBUS wehelpbus-0.2.tar.gz                  http://prdownloads.sourceforge.net/wehelpbus/wehelpbus-0.2.tar.gz?down         load

- 漏洞信息

OSVDBID: 10777
漏洞名称:WeHelpBUS sk.cgi.in Query String Arbitrary Command Execution
漏洞位置: Remote / Network Access	利用方式: Input Manipulation
漏洞影响:Loss of Integrity	解决方式:
漏洞利用:Exploit Unknown	公开方式:Vendor Verified

- 漏洞描述

WeHelpBUS contains a flaw that allows a remote command execution attack. This flaw exists because the application does not validate the QUERY_STRING variable upon submission to the sk.cgi.in script. This allows users to execute shell commands with the privileges of the web server.

- 时间线

公开日期: 2004-10-14	发现日期: 2004-10-14
利用日期:2004-10-14	解决日期:Unknow

- 解决方案

Upgrade to version 0.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

Security Tracker: 1011743 Related OSVDB ID: 10834 10835 10836 10837 10838 10839 Bugtraq ID: 11431 Secunia Advisory ID: 12831 CVE ID: 2004-2183 (see also: NVD) Vendor Specific News/Changelog Entry: http://sourceforge.net/project/shownotes.php?release_id=275295 Vendor URL: http://wehelpbus.sourceforge.net/

- 漏洞作者

Unknown or Incomplete