An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint. This vulnerability allows for significant security risks, including unauthorized access and potential data breaches. It is classified as critical due to its high base score and the potential impact on confidentiality, integrity, and availability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.4 | CVE-2025-48047 |
Exploitation
To exploit this vulnerability, an attacker must be an authenticated user who can send crafted requests to the /test.php endpoint of the NetFax Server. By injecting unsanitized input into the ping functionality, the attacker can execute arbitrary commands on the server, leading to potential data compromise or system control.
Affected Products
- NetFax Server: Affected by command injection vulnerability allowing unauthorized command execution.
Mitigation
To mitigate this vulnerability, it is essential to sanitize all user inputs and implement strict access controls. Regular updates and patches should be applied to the NetFax Server to protect against known vulnerabilities.
References