QwikSec

Security Database

CVE

CWE

Training

CVE-2011-10017

Published: Aug 13, 2025

Modified: May 15, 2026

PUBLISHED

Description

Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and can result in full compromise of the underlying system.

Vendor	Product	Versions
Symmetrix Technologies	Snort Report	affected `0 - < 1.3.2`

Weaknesses (CWE)

References

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/snortreport_exec.rb

exploit

https://www.exploit-db.com/exploits/17947

exploit

https://web.archive.org/web/20111003093911/http://www.symmetrixtech.com/articles/news-016.html

vendor-advisory

patch

https://www.vulncheck.com/advisories/snort-report-rce

third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.