CVE-2020-9380 PoC — IPTV Smarters WEB TV PLAYER 代码问题漏洞

Source

Associated Vulnerability

Description

https://medium.com/@anderson_pablo/iptv-smarters-exploit-cve-2020-9380-22d4b21f5da7

Readme

# PoC IPTV Smarters Exploit

## Usage
`python gld.py -u http://www.pirate-ilegal-tv.com/ -i`


## Vulnerability 

### file `includes/ajax-control.php`:
```
<?php
/*
 * @ PHP 5.6
 * @ Decoder version : 1.0.0.1
 * @ Release on : 24.03.2018
 * @ Website    : http://EasyToYou.eu
 */

session_start();
if (file_exists("functions.php")) {
    include_once "functions.php";
    if (isset($_FILES["logoImage"])) {
        $target_dir = "../images/";
        $target_file = $target_dir . basename($_FILES["logoImage"]["name"]);
        if (move_uploaded_file($_FILES["logoImage"]["tmp_name"], $target_file)) {
            echo "images/" . $_FILES["logoImage"]["name"];
            exit;
        }
        echo "errorImage";
        exit;
    }
 ```

## Screenshot
![screenshot](screenshot.png)

## Shell Script Interactive in Python.
![](CVE-2020-9083.gif)

File Snapshot

 [4.0K]  /data/pocs/0f83b9d18594ce3a6831e9ebdbf121cb4db0b121
├── [700K]  CVE-2020-9083.gif
├── [2.8K]  gld.py
├── [4.0K]  patch
│   └── [ 66K]  ajax-control.php
├── [ 852]  README.md
└── [354K]  screenshot.png

1 directory, 5 files

Remarks