VYPR
← All advisories
Critical severity9.8OSV Advisory· Published Jun 8, 2018· Updated Jun 17, 2026

CVE-2018-9246

CVE-2018-9246

Description

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Ledgersmb/LedgersmbOSV3 versions
    1.5.0, 1.5.1, 1.5.10, …+ 2 more
    • (no CPE)range: 1.5.0, 1.5.1, 1.5.10, …
    • cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*range: >=1.5.0,<=1.5.21
    • (no CPE)range: <=1.5.x
  • Pgobject Util Dbadmin Project/Pgobject Util Dbadmin
    cpe:2.3:a:pgobject-util-dbadmin_project:pgobject-util-dbadmin:*:*:*:*:*:perl:*:*
    Range: <0.120.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.