Secunia

SEC Consult has reported a vulnerability in Fujitsu-Siemens WebTransactions, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an input validation error when cleaning up temporary session data, which can be exploited to inject and execute arbitrary commands via a specially crafted HTTP request.

The vulnerability is reported in WebTransactions 7.0 and 7.1.

Solution
The vendor has issued patches (please see the vendor advisory for details).

Provided and/or discovered by
SEC Consult

Changelog
Further details available in Customer Area

Original Advisory
Fujitsu-Siemens:
http://bs2www.fujitsu-siemens.de/update/securitypatch.htm#download

SEC Consult:
http://www.sec-consult.com/files/20081219-0_fujitsu-siemens_webta_cmdexec.txt

Deep Links
Links available in Customer Area