F5 FirePass SSL VPN Remote Code Execution Vulnerability

Multiple vulnerabilities have been identified in F5 FirePass, which can be exploited by malicious user to include and execute PHP code on the target system.

The 'CitrixAuth.php' script does not properly validate user-supplied input in the 'sessionId' parameter. A remote user can supply a specially crafted URL to cause the target system to include and execute files located on the target system.  A remote user can also exploit this flaw to view or delete files located on the target system.