Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2022-24989 PoC — TerraMaster NAS 注入漏洞

Source
https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/TerraMaster%20TOS%20createRaid%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2022-24989.md
Associated Vulnerability
Title:TerraMaster NAS 注入漏洞 (CVE-2022-24989)
Description:TerraMaster NAS是中国铁威马（TerraMaster）公司的一个共享式文件存储设备。 TerraMaster NAS 存在安全漏洞，该漏洞源于通过对 api.php?mobile/createRaid 的 raidtype 和 diskstring 参数进行 PHP 对象实例化可以用来执行任意代码（因为 popen 被使用而没有进行任何过滤）。
File Snapshot

 # TerraMaster TOS createRaid 远程命令执行漏洞 CVE-2022-24989

## 漏洞描述

TerraMaster TOS mobile.class.php文件的cr

...
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.