CVE-2018-7841 PoC — Schneider Electric U.Motion Builder SQL注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7841.yaml

Associated Vulnerability

Title:Schneider Electric U.Motion Builder SQL注入漏洞 (CVE-2018-7841)
Description:Schneider Electric U.Motion Builder是法国施耐德电气（Schneider Electric）公司的一套建筑物智能管理系统。 Schneider Electric U.Motion Builder 1.3.4及之前版本中的track_import_export.php脚本中存在操作系统命令注入漏洞，该漏洞源于外部输入数据构造操作系统可执行命令过程中，网络系统或产品未正确过滤其中的特殊字符、命令等。攻击者可利用该漏洞执行非法操作系统命令。

Description

U.motion Builder 1.3.4 contains a remote code execution vulnerability caused by improper input sanitization, allowing attackers to execute arbitrary system commands through crafted input parameters.

File Snapshot


 id: CVE-2018-7841

info:
  name: Schneider Electric U.motion Builder - Remote Code Execution
  autho

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!