CVE-2021-36260 PoC — Hikvision Web Server 操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/iot/hikvision-cam-info-exposure.yaml

Associated Vulnerability

Title:Hikvision Web Server 操作系统命令注入漏洞 (CVE-2021-36260)
Description:Hikvision Web Server是中国海康威视（Hikvision）公司的一个Web服务器。用于解析协议，提供服务。 Hikvision Web Server 中存在操作系统命令注入漏洞，该漏洞源于输入验证不足。攻击者可利用该漏洞通过发送带有恶意命令的消息来发起命令注入攻击。

Description

Unauthenticated exposure of sensitive endpoints was detected on vulnerable Hikvision IP cameras. This included live snapshot feeds, encrypted configuration files, and full user credential XML through CVE-2021-36260 exploit chaining and bypass logic.

File Snapshot


 id: hikvision-cam-info-exposure

info:
  name: Hikvision IP Camera - Info Exposure
  author: Abdulra

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!