SOUND4 Impact/Pulse/First/Eco Conditional Command Injection Vulnerability in ping.php

A conditional command injection vulnerability exists in SOUND4 IMPACT, FIRST, PULSE, and Eco versions through 2.x. This vulnerability allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by sending an HTTP POST request to the vulnerable ping.php script, which activates the malicious file and subsequently deletes it.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the system.

Reproduction

To reproduce this vulnerability, a local authenticated user can create a file in the /tmp directory with a .ping.pid extension, containing malicious commands. After the file is created, an external unauthenticated attacker can execute the commands by sending a single HTTP POST request to ping.php, including the 'ping_host' and 'networkid' parameters. The executed commands will be processed, and the file will be deleted afterward.