CVE-2020-15568 PoC — Terramaster TOS 操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15568.yaml

Associated Vulnerability

Title:Terramaster TOS 操作系统命令注入漏洞 (CVE-2020-15568)
Description:Terramaster TOS是中国铁威马（Terramaster）公司的一款基于Linux平台的，专用于erraMaster云存储NAS服务器的操作系统。 TerraMaster TOS before 4.1.29 存在操作系统命令注入漏洞，该漏洞源于无效的参数检查，导致代码以root注入。

Description

TerraMaster TOS before 4.1.29 has invalid parameter checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.

File Snapshot


 id: CVE-2020-15568

info:
  name: TerraMaster TOS <.1.29 - Remote Code Execution
  author: pikpikcu


...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!