| शीर्षक | TOTOLINK A3300R V17.0.0cu.592_B20231030 Command Injection |
|---|
| विवरण | The remote syslog handler setSyslogCfg reads the rtLogServer field of the JSON request body and, when the rtLogEnabled field is non-zero, composes the shell string syslogd -R <rtLogServer>:514. The value is inserted between a space and a literal :514 suffix with no quoting and no filtering, so a semicolon terminates the syslogd invocation and introduces an arbitrary command. The composed string is executed through CsteSystem, which runs /bin/sh -c with that text under the root account used by the web server. The value is also written into the syslog.host configuration option, so the payload persists in the device configuration. The handler is registered in the dispatch table as requiring authentication, and the proof of concept below therefore establishes an authenticated session through loginAuth and supplies the resulting identifier as the token query parameter before the injection is attempted. A separate killall syslogd invocation runs before the composed command and is itself constant, so the injection vector is solely the server address field. The outcome is arbitrary command execution as root combined with a persistent configuration modification. |
|---|
| स्रोत | ⚠️ https://gist.github.com/H3rmesk1t/1b5a45bba65b1ac521448b4c0d62833f |
|---|
| उपयोगकर्ता | LiuYijun (UID 101805) |
|---|
| सबमिशन | 30/09/2026 08:21 AM (18 दिन पहले) |
|---|
| संयम | 17/10/2026 11:58 PM (18 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 329931 [TOTOLINK A3300R 17.0.0cu.557_B20221024 POST Parameter /cgi-bin/cstecgi.cgi setSyslogCfg enable बफ़र ओवरफ़्लो] |
|---|
| अंक | 0 |
|---|