CVE-2022-39986 PoC — RaspAP 命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39986.yaml

Associated Vulnerability

Title:RaspAP 命令注入漏洞 (CVE-2022-39986)
Description:RaspAP是应用软件基于 Debian 的设备的简单无线 AP 设置和管理 RaspAP 2.8.0至2.8.7版本存在安全漏洞，该漏洞源于存在命令注入漏洞。允许攻击者通过参数cfg_id执行任意命令。

Description

A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.

File Snapshot


 id: CVE-2022-39986

info:
  name: RaspAP 2.8.7 - Unauthenticated Command Injection
  author: Dhiyane

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!