CVE-2013-3631

NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature.  NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:S/C:P/I:P/A:P
certccCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
VendorProductVersion
nas4freenas4free
𝑥
≤ 9.1.0.1.804
nas4freenas4free
9.1.0.1.798
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.kb.cert.org/vuls/id/326830
https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats
http://www.kb.cert.org/vuls/id/326830
https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats