.. / CVE-2014-9618

Exploit for Netsweeper - Authentication Bypass (CVE-2014-9618)

Description:

The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL.

Nuclei Template

View the template here CVE-2014-9618.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2014/CVE-2014-9618.yaml
Copy

References:

https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz
https://www.exploit-db.com/exploits/37933/
https://nvd.nist.gov/vuln/detail/CVE-2014-9618
https://github.com/ARPSyndicate/kenzer-templates
http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html