TestLink Unauthenticated Remote Code Execution

This strike exploits a code injection vulnerability in TestLink Open Source Test Management. The vulnerability is due to improper sanitization and handling of user-controlled values passed for "TestLink DB login" parameter in "installNewDB.php" script. By exploiting this vulnerability, a remote, unauthenticated attacker can inject and execute arbitrary PHP code on the target server. NOTE: When run in one-arm mode, a Mysql server must be accessible at "localhost" and user "root" with password "12345" must be configured. Also a database called "testlink" must be created and Mysql must be configured to accept usernames longer that 16 characters.