CVE-2018-11511 PoC — ASUSTOR ADM photo gallery应用程序SQL注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11511.yaml

Associated Vulnerability

Title:ASUSTOR ADM photo gallery应用程序SQL注入漏洞 (CVE-2018-11511)
Description:ASUSTOR ADM是华芸科技（ASUSTOR）公司的一套专用于ASUSTOR NAS存储设备的操作系统。photo gallery是其中的一个图片管理应用程序。 ASUSTOR ADM 3.1.0.RFQ3版本中的photo gallery应用程序的tree list功能的‘album_id’和‘scope’参数存在SQL注入漏洞。远程攻击者可借助photo-gallery/api/album/tree_lists/ URI利用该漏洞执行任意SQL命令。

Description

ASUSTOR ADM version 3.1.0.RFQ3 is vulnerable to SQL injection via the album_id parameter in the /photo-gallery/api/album/tree_lists/ endpoint. An attacker can exploit this vulnerability to execute arbitrary SQL commands on the database, potentially leading to information disclosure or further compromise of the affected system.

File Snapshot


 id: CVE-2018-11511

info:
  name: ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection
  author: ritikchaddha
  se

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!