CVE-2017-6971

CVE-2017-6971 describes a critical command injection vulnerability affecting AlienVault USM and OSSIM before version 5.3.7, and NfSen before 1.3.8. This flaw allows remote authenticated attackers to execute arbitrary commands in a privileged context or launch a reverse shell by manipulating the PHP session ID in conjunction with NfSen PHP code. With a CVSS score of 8.8 (HIGH), the vulnerability is easily exploitable over the network with low attack complexity and user privileges, leading to high impacts on confidentiality, integrity, and availability. While not listed on the KEV catalog or showing active exploitation, public exploit code (EDB-42306) exists, though there is minimal community discussion or media coverage.