Loading vulnerability…
CVE-2011-10017 affects Snort Report versions prior to 1.3.2. The vulnerability is present in the nmap.php and nbtscan.php scripts, which do not properly sanitize user-supplied input provided through the target GET parameter before passing it to shell command execution. An attacker can supply crafted input to inject arbitrary operating system commands, resulting in remote command execution on the host running Snort Report.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module (snortreport_exec.rb) that exploits a remote command execution vulnerability in SnortReport's nmap.php and nbtscan.php scripts (CVE-2011-10017). The exploit works by sending a specially crafted HTTP GET request to the vulnerable script, injecting a base64-encoded payload via the 'target' parameter, which is then decoded and executed on the server. The module supports arbitrary command execution using Metasploit's command payloads, targeting Linux and Unix platforms. The only file in the repository is a Ruby script structured as a standard Metasploit exploit module, with clear references to the affected product, CVE, and usage instructions. The main attack vector is network-based, requiring HTTP access to the vulnerable scripts. The endpoints of interest are the nmap.php and nbtscan.php scripts, typically located under the /snortreport-1.3.2/ path.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.