Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without properly sanitizing any shell arguments, therefore remote code execution is possible. Additionally, as the media server is running as root by default attackers can use the sudo command within this shell_exec(''); function, which allows for privilege escalation by means of RCE.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
QuickBox 操作系统命令注入漏洞
Vulnerability Description
QuickBox是Quickbox团队的一套媒体服务器应用程序和服务管理系统。该系统支持使用仪表板实现应用程序的安装和管理，使用户能够与媒体服务器进行交互。 QuickBox Pro v2.5.8 版本及以下版本中存在安全漏洞，该漏洞源于 config.php 文件有一个变量，该变量接受一个 GET 参数值并将其解析为 shell_exec()且没有正确清理任何 shell 参数，因此可以远程执行代码。 此外，由于媒体服务器默认以 root 身份运行，因此攻击者可以在 shell_exec(); 中使用
CVSS Information
N/A
Vulnerability Type
N/A