CVE-2014-9610 – Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allo

Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and remove IP addresses from the quarantine via the ip parameter to webadmin/user/quarantine_disable.php.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9610

Reference (s):

• EXPLOIT-DB:37929
• URL: https://www.exploit-db.com/exploits/37929/
• http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html