CVE-2020-12078
highpriority · attend · 48EPSS 0.100 · 96 %ileexploit · PoCEUUSEPSS · scored 2026-10-28
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://gist.github.com/mhaskar/dca62d0f0facc13f6364b8ed88d5a7fdcnnvd
- https://github.com/Opmantek/open-audit/commit/6ffc7f9032c55eaa1c37cf5e070809b7211c7e9acnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-12078cnnvd
- https://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.htmlcnnvd
- https://shells.systems/open-audit-v3-3-1-remote-command-execution-cve-2020-12078/cnnvd
- http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.htmlenisa_euvd
- https://gist.github.com/mhaskar/dca62d0f0facc13f6364b8ed88d5a7fdenisa_euvd
- https://github.com/Opmantek/open-audit/commit/6ffc7f9032c55eaa1c37cf5e070809b7211c7e9aenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan