meterN Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in meterN version 1.2.3. This vulnerability exists in the admin_meter2.php and admin_indicator2.php scripts, where the 'COMMANDx' and 'LIVECOMMANDx' POST parameters can be exploited to execute arbitrary system commands. The vulnerability requires authentication and can be exploited with administrative privileges.

Impact

Exploitation of this vulnerability allows authenticated users to execute arbitrary system commands with administrative rights, potentially leading to unauthorized access or modification of system resources.

Reproduction

To reproduce this vulnerability, send a POST request to either 'admin_meter2.php' or 'admin_indicator2.php' with the 'COMMANDx' or 'LIVECOMMANDx' parameters containing the desired command to execute. This can be done through a crafted HTML form or using a tool like cURL, after logging in as an administrator.

Remediation

Users can upgrade to meterN version 1.2.4.1, which addresses this vulnerability.