CVE-2020-13167 PoC — Netsweeper 注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13167.yaml

Associated Vulnerability

Title:Netsweeper 注入漏洞 (CVE-2020-13167)
Description:Netsweeper是加拿大Netsweeper公司的一套Web内容过滤解决方案。 Netsweeper 6.4.3及之前版本中的/webadmin/tools/unixlogin.php脚本存在安全漏洞。攻击者可利用该漏洞执行代码。

Description

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.

File Snapshot


 id: CVE-2020-13167

info:
  name: Netsweeper <=6.4.3 - Python Code Injection
  author: dwisiswant0
 

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!