Vulnerability Description
The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pgobject-Util-Dbadmin Project | Pgobject-Util-Dbadmin | < 0.120.0 |
| Ledgersmb | Ledgersmb | >= 1.5.0, <= 1.5.21 |
Related Weaknesses (CWE)
References
- https://archive.ledgersmb.org/ledger-smb-announce/msg00280.htmlVendor Advisory
- https://archive.ledgersmb.org/ledger-smb-announce/msg00280.htmlVendor Advisory
FAQ
What is CVE-2018-9246?
CVE-2018-9246 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting i...
How severe is CVE-2018-9246?
CVE-2018-9246 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-9246?
Check the references section above for vendor advisories and patch information. Affected products include: Pgobject-Util-Dbadmin Project Pgobject-Util-Dbadmin, Ledgersmb Ledgersmb.