| शीर्षक | vivotek SD9364 VVTK-0103f command injection |
|---|
| विवरण | vivotek SD9364 has command injection vulnerability in upload_file.cgi. The program receives the attacker's GET request through the getenv function at line 59, obtains the value of the first field through the code at line 67, and concatenates it into a formatted string using the snprintf function. Finally, the systemfunction is used to execute the system command. Because the attacker's input is not filtered, any command can be executed. |
|---|
| स्रोत | ⚠️ https://yjz233.notion.site/vivotek-SD9364-has-command-injection-vulnerability-in-upload_file-cgi-5cef6da27b25479497dda0b73670f565?pvs=4 |
|---|
| उपयोगकर्ता | jylsec (UID 60282) |
|---|
| सबमिशन | 31/07/2024 03:34 PM (2 साल पहले) |
|---|
| संयम | 02/08/2024 11:36 PM (2 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 273527 [Vivotek SD9364 VVTK-0103f upload_file.cgi getenv QUERY_STRING अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|