CVE-2020-7980 PoC — Intellian Aptus Web 操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7980.yaml

Associated Vulnerability

Title:Intellian Aptus Web 操作系统命令注入漏洞 (CVE-2020-7980)
Description:Intellian Aptus Web 1.24版本中存在操作系统命令注入漏洞。远程攻击者可借助JSON数据中的Q字段利用该漏洞执行任意操作系统命令。

Description

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.

File Snapshot


 id: CVE-2020-7980

info:
  name: Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution
  

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.