CVE-2021-3122 PoC — NCR Command Center Agent 操作系统命令注入漏洞

Source

https://github.com/acquiredsecurity/CVE-2021-3122-Details

Associated Vulnerability

Title:NCR Command Center Agent 操作系统命令注入漏洞 (CVE-2021-3122)
Description:NCR Aloha Essentials是美国NCR公司的移动POS功能硬件。提供了端到端的餐厅管理平台 NCR Command Center Agent 16.3 中的 CMCAgent存在安全漏洞，该漏洞源于允许提交runCommand参数(在XML文档发送到端口8089),未经身份验证攻击者可利用该漏洞执行任意命令系统。

Readme

# CVE-2021-3122-Details

Blog Post on how we found a CVE in AlohaPOS.
https://www.sentinelone.com/blog/cve-2021-3122-how-we-caught-a-threat-actor-exploiting-ncr-pos-zero-day/

File Snapshot


 [4.0K]  /data/pocs/23cc056fe1ffd491250743da8c0002a23403742e
├── [3.4K]  CVE-2021-3122
└── [ 175]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!