Quest DR Series Disk Backup软件操作系统命令注入漏洞

http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201806-046

Quest DR Series Disk Backup software是美国Quest Software公司的一套使用在DR系列磁盘备份设备中的软件。 Quest DR Series Disk Backup软件4.0.3.1之前版本中存在操作系统命令注入漏洞。攻击者可借助‘hostname’请求参数利用该漏洞注入操作系统命令。

resource:Third Party Advisory
hyperlink:http://packetstormsecurity.com/files/148003/Quest-DR-Series-Disk-Backup-Software-4.0.3-Code-Execution.html
resource:Mailing List
hyperlink:http://seclists.org/fulldisclosure/2018/May/71
resource:Technical Description
hyperlink:https://www.coresecurity.com/advisories/quest-dr-series-disk-backup-multiple-vulnerabilities