It appears that most diagnostic CGI perl scripts that take user-supplied input are vulnerable to Remote Command Execution. These scripts are located on '/html/cswebadm/basic/cgi-bin/'. All the RCE vulnerabilities discovered were tested with an authenticated session using the 'craft' account. These vulnerabilities might also be exploitable by less-privileged accounts, but this has NOT been tested. The web interface of Avaya Intuity AUDIX LX is also vulnerable to XSS and CSRF which can be used in conjunction with the RCE vulnerabilities in different exploitation scenarios. Successfully tested on: Avaya IntuityTM AUDIX LX R1.1. Other versions might also be affected. Avaya has stated that IALX 1.1, which was discontinued in 2007, is the latest vulnerable version. IALX 2.0 SP2 is not vulnerable according to Avaya. Complete technical details can be found in the following document: http://www.gnucitizen.org/static/blog/2009/09/Avaya_Intuity_Remote_Command_Execution.pdf -- pagvac | GNUCITIZEN.org
