O'Reilly WebSite 1.1e and Website Pro 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in an argument to (1) args.cmd or (2) args.bat.
| Software | From | Fixed in |
|---|---|---|
| oreilly / website_pro | 2.0 | 2.0.x |
| oreilly / website_pro | 2.1 | 2.1.x |
| oreilly / website | 1.1e | 1.1e.x |
| oreilly / website_pro | - | 2.4.x |