| tiêu đề | SECCN SECCN G10 VPN V3.1.0.181203 Unauthorized RCE |
|---|
| Mô tả | Technical Analysis (Vulnerability Logic):
Source of Taint: The variable $in{user} is a controlled input fetched directly from a Web POST request via the ReadParse function.
Insecure Sink: The script utilizes Perl's system qq(...) function to execute backend logic. In Perl, qq acts as a double-quote interpolator, meaning it evaluates and embeds variables into the string before passing it to the system shell.
Exploitation (Command Chaining): Because the $in{user} variable is not sanitized, an attacker can inject a shell command separator (;). For instance, a payload like 13800000000;telnetd -p 9999; transforms the command into a multi-step execution:
Step 1: user_auth.pl ... 13800000000 (Original intended command)
Step 2: telnetd -p 9999 (Injected malicious command)
Step 3: [trailing_random_numbers] (System noise)
Pre-Auth Reachability: The injection point is located within the SMS verification trigger logic. Since this functionality must be accessible before a user is authenticated, it allows for a complete Pre-auth RCE. |
|---|
| Nguồn | ⚠️ https://github.com/cha0yang1/SECCN/blob/main/UnauthorizedRCE.md |
|---|
| Người dùng | Ruler-Chovy (UID 95098) |
|---|
| Đệ trình | 08/02/2026 09:19 (cách đây 8 các tháng) |
|---|
| Kiểm duyệt | 18/02/2026 15:13 (10 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 346488 [SECCN Dingcheng G10 3.1.0.181203 session_login.cgi qq user nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|