This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐ก๏ธ **Root Cause**: Missing **Authentication** and **Input Validation**. The endpoint `/Config/SaveUploadedHotspotLogoFile` accepts POST requests without verifying user identity or checking file extensions/content.โฆ
๐ฏ **Affected**: **SonLogger** software by Sonlogger (Turkey). ๐ **Version**: All versions **before 6.4.1**. ๐ฆ Specific mention of 4.2.3.3 in exploits. โ ๏ธ Check your version immediately!
Q4What can hackers do? (Privileges/Data)
๐ป **Attacker Actions**: Upload arbitrary files (like `.php` or `.jsp` shells). ๐ **Privileges**: No auth required. ๐ **Data**: Full server access if the uploaded file is executed.โฆ
๐ **Threshold**: **VERY LOW**. ๐ช **Auth**: None required. ๐ก **Config**: Just send a POST to `/Config/SaveUploadedHotspotLogoFile`. ๐ฏ Extremely easy to exploit for anyone with network access. ๐
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **Public Exp?**: **YES**. ๐ PoC available via **Nuclei Templates** and PacketStorm. ๐ Wild exploitation is likely given the ease of use. ๐ฅ GitHub links provided in references. โก
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for SonLogger instances. ๐งช Test POST request to `/Config/SaveUploadedHotspotLogoFile` without headers. ๐ค Try uploading a test file. ๐จ If it accepts without auth, you are vulnerable! ๐
Q8Is it fixed officially? (Patch/Mitigation)
๐ก๏ธ **Fixed?**: **YES**. โ **Patch**: Upgrade to **SonLogger version 6.4.1** or later. ๐ฅ Download from official release notes. ๐ This resolves the auth and validation flaws. ๐
Q9What if no patch? (Workaround)
๐ง **No Patch?**: **Workaround**: Block external access to `/Config/SaveUploadedHotspotLogoFile`. ๐ซ Use WAF rules to deny POST requests to this endpoint. ๐ Restrict network access to the admin interface. ๐ก๏ธ
Q10Is it urgent? (Priority Suggestion)
โก **Urgency**: **CRITICAL**. ๐ด **Priority**: Patch immediately. ๐จ Unauthenticated RCE risk is high. ๐ Low exploitation barrier means active attacks are probable. ๐โโ๏ธ Don't wait! ๐