CyberSec.Space Logo
Back to CVE Browser

CVE-2014-6287

Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score92.5540%
EPSS Percentile92.39th
PublishedOct 7, 2014
Last ModifiedApr 22, 2026

Vulnerability Description

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

Affected Platforms (CPE)

📦
Rejetto

Http File Server

>= 2.3 and < 2.3c

References & Advisories

🔗 http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html
🔗 http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
🔗 http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html
🔗 http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
🔗 http://www.kb.cert.org/vuls/id/251276
🔗 https://github.com/rapid7/metasploit-framework/pull/3793
🔗 https://www.exploit-db.com/exploits/39161/
🔗 http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html

Related Vulnerabilities

CVE-2012-450510.0

Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an...

CVE-2020-2628210.0

BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR f...

CVE-2008-040510.0

Multiple directory traversal vulnerabilities in HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, ...

CVE-2019-106479.8

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.ph...