CVE-2021-3317 PoC — KLog 命令注入漏洞

Source

https://github.com/Al1ex/CVE-2021-3317

Associated Vulnerability

Title:KLog 命令注入漏洞 (CVE-2021-3317)
Description:KLog是ZhaoKaiQiang（KLog）个人开发者的一款用于安卓开发的日志工具。该工具主要功能为打印行号、函数调用、Json解析、XML解析、点击跳转、Log信息保存等功能。 KLog Server through 2.4.1存在命令注入漏洞，该漏洞源于程序允许通过认证的命令注入。async.php在源参数的原始值上调用shell_exec()。

Description

CVE-2021-3317

Readme

## Information
Exploit Title: Klog Server 2.4.1 - Command Injection (Authenticated)

Date: 26.01.2021

Exploit Author: Metin Yunus Kandemir

Vendor Homepage: https://www.klogserver.com/

Version: 2.4.1

Description: https://docs.unsafe-inline.com/0day/klog-server-authenticated-command-injection

CVE: 2021-3317

## How to use
```
python3 PoC.py --target 10.10.56.51 --username admin --password admin --command id 
[*] Status Code for login request: 302
[+] Authentication was successful!
[*] Exploiting...

uid=48(apache) gid=48(apache) groups=48(apache)
```

## Reference
https://docs.unsafe-inline.com/0day/klog-server-authenticated-command-injection

File Snapshot


 [4.0K]  /data/pocs/7385b54d5500d9d4c535342b6dc63207e08348e1
├── [3.2K]  klogserver_authenticated_command_injection.py
└── [ 681]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!