CVE-2019-17270 PoC — Yachtcontrol 操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17270.yaml

Associated Vulnerability

Title:Yachtcontrol 操作系统命令注入漏洞 (CVE-2019-17270)
Description:Yachtcontrol是荷兰Yachtcontrol公司的一套船舶导航系统。 Yachtcontrol 2019-10-06及之前版本中存在安全漏洞。攻击者可利用该漏洞执行操作系统命令。

Description

Yachtcontrol Webapplication 1.0 makes it possible to perform direct operating system commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects Yachtcontrol webservers disclosed via Dutch GPRS/4G mobile IP-ranges. IP addresses vary due to DHCP client leasing of telco's.

File Snapshot


 id: CVE-2019-17270

info:
  name: Yachtcontrol Webapplication 1.0 - Remote Command Injection
  autho

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!