漏洞关键信息 EDB-ID: 45037 CVE: N/A Author: LIQUIDWORM Type: WEBAPPS Platform: HARDWARE Date: 2018-07-17 Vulnerable App: Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Affected Versions: - IPn4G 1.1.0 build 1098 - IPn3Gb 2.2.0 build 2160 - IPn4Gb 1.1.6 build 1184-14 - IPn4Gb 1.1.0 Rev 2 build 1090-2 - IPn4Gb 1.1.0 Rev 2 build 1086 - Bullet-3G 1.2.0 Rev A build 1032 - VIP4Gb 1.1.6 build 1204 - VIP4G 1.1.6 Rev 3.0 build 1184-14 Description: Due to the hidden and undocumented File Editor (Filesystem Browser) shell script 'system-editor.sh', an attacker can leverage this issue to read, modify, or delete arbitrary files on the system. Input passed through the 'path' and 'savefile', 'edit', and 'delfile' GET and POST parameters is not properly sanitized before being used to modify files. This can be exploited by an authenticated attacker to read or modify arbitrary files on the affected system. Tested on: httpd-ssl-1.0.0, Linux 2.6.32.9 (Bin@DProBuilder) (gcc version 4.4.3) Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic Advisory ID: ZSL-2018-5485 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5485.php Exploit Details: - Download script exploit - CSRF add root:rewt to htpasswd - HTML form for edit action - Example GET request for delete action - Edit and remove sanitization script