| 제목 | vivotek IB8367A VVTK-0100b command injection |
|---|
| 설명 | vivotek IB8367A has command injection vulnerability in upload_file.cgi.The program receives the attacker's GET request through the getenv function at line 61, obtains the value of the first field through the code at line 69, and concatenates it into a formatted string using the snprintf function. Finally, the systemfunction is used to execute the system command. Because the attacker's input is not filtered, any command can be executed. |
|---|
| 원천 | ⚠️ https://yjz233.notion.site/vivotek-IB8367A-has-command-injection-vulnerability-in-upload_file-cgi-899e5d529fb14b4189534b2b9830bfff?pvs=4 |
|---|
| 사용자 | jylsec (UID 60282) |
|---|
| 제출 | 2024. 07. 31. PM 03:35 (2 연령 ago) |
|---|
| 모더레이션 | 2024. 08. 02. PM 11:36 (2 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 273528 [Vivotek IB8367A VVTK-0100b upload_file.cgi getenv QUERY_STRING 권한 상승] |
|---|
| 포인트들 | 17 |
|---|