| शीर्षक | The C-Data Wi-Fi web management system has an unauthorized RCE vulnerability |
|---|
| विवरण | The C-Data Wi-Fi web management system has an unauthorized remote code execution vulnerability, through which an attacker can obtain server permissions.
In the cgi-bin directory jumpto.php you can jump to PHP or html files in the same directory by concatenating GET parameters. The ping function is available in the diagnosis_config_save.php file in the diagnosis directory in the sibling directory. When the call_function is specified as ping, the function accepts the iface parameter of post and the hostname parameter, concatenates the instruction and executes. However, the incoming iface and hostname parameters are not verified here, so arbitrary command execution can be achieved through the construction stage.
Vendor address：https://cdatatec.com/
POC：https://github.com/siriuswhiter/VulnHub/blob/main/C-Data/rce1.md |
|---|
| स्रोत | ⚠️ https://github.com/siriuswhiter/VulnHub/blob/main/C-Data/rce1.md |
|---|
| उपयोगकर्ता | ireading (UID 36553) |
|---|
| सबमिशन | 01/12/2022 12:28 PM (4 साल पहले) |
|---|
| संयम | 01/12/2022 02:30 PM (2 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 214631 [C-DATA Web Management System GET Parameter cgi-bin/jumpto.php होस्टनाम अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|