WebGUI contains a flaw that may allow a remote malicious user to execute arbitrary commands. This flaw exists because the application does not properly filter specially crafted parameters upon submission to the 'lib/WebGUI/Asset.pm' script, in the www_add function, when adding a new Asset. It is possible that the flaw may allow the execution of arbitrary code resulting in a loss of integrity.

Upgrade to version 6.7.6 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s):

1) Edit lib/WebGUI/Asset.pm
2) Add the following line as the first line in the www_add method:
return "" unless ($session{form}{class} =~ m/^[A-Za-z0-9\:]+$/);
3) Save the file
4) Restart apache.

• Bugtraq ID: 15083
• Secunia Advisory ID: 17158
• CVE ID: 2005-4694 (see also: NVD)
• ISS X-Force ID: 22730
• VUPEN Advisory: ADV-2005-2060
• Other Advisory URL: http://secwatch.org/advisories/1011855
• Vendor Specific News/Changelog Entry: http://www.plainblack.com/getwebgui/advisories/security-exploit-patch-for-6.3-and-above
  http://www.plainblack.com/getwebgui/advisories/webgui-6.7.6-gamma-released

Unknown or Incomplete