Hundreds of ScriptCase web apps are vulnerable to two bugs that allow attackers to reset passwords and inject malicious commands without needing to authenticate.
According to VulnCheck, exploitation is simple and only requires a few curl commands.
ScriptCase - Hunt It, Exploit It, Defend It | Blog | VulnCheck
A month after disclosure, hundreds of ScriptCase servers remain exposed and actively targeted. This post walks through finding vulnerable instances, exploiting them with just a few curl commands, and the key detection points defenders can use to stop attacks.
VulnCheck (www.vulncheck.com)
