CVE-2024-3273 PoC — D-Link DNS-320 命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3273.yaml

Associated Vulnerability

Title:D-Link DNS-320 命令注入漏洞 (CVE-2024-3273)
Description:D-Link DNS-320是中国友讯（D-Link）公司的一款NAS（网络附属存储）设备。 D-Link DNS-320L存在命令注入漏洞，该漏洞源于文件/cgi-bin/nas_sharing.cgi存在命令注入漏洞。受影响的产品和版本：D-Link DNS-320L，DNS-325，DNS-327，DNS-340L，D-Link NAS Storage。

Description

UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

File Snapshot


 id: CVE-2024-3273
info:
  name: D-Link Network Attached Storage - Command Injection and Backdoor Acc

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!