CVE-2022-33174 PoC — Powertek PDU 安全漏洞

Source

https://github.com/Henry4E36/CVE-2022-33174

Associated Vulnerability

Title: Powertek PDU 安全漏洞 (CVE-2022-33174)
Description:Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.

Description

Powertek PDU身份绕过

Readme

# CVE-2022-33174
Powertek PDU身份绕过

# Optional Arguments:

  -h, --help            show this help message and exit
  
  -u url, --url url     Target url eg:"http://127.0.0.1"
  
  -f file, --file file  Targets in file eg:"ip.txt"
  
# Use
  
python3 CVE-2022-33174.py -u http://127.0.0.1

python3 CVE-2022-33174.py -f ip.txt

# Link
https://henry4e36.top/index.php/archives/98.html

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →