Displaying items by tag: perl

Apache 2.4.49 / 2.4.50 Traversal / Remote Code Execution

CGI Files ≈ Packet Storm Oct 25, 2021 | 17:10 pm

This Metasploit module exploits an unauthenticated remote code execution vulnerability which exists in Apache version 2.4.49 (CVE-2021-41773). If files outside of the document root are not protected by ‘require all denied’ and CGI has been explicitly enabled, it can be[…]

Geutebruck instantrec Remote Command Execution

CGI Files ≈ Packet Storm Sep 17, 2021 | 16:02 pm

This Metasploit module exploits a buffer overflow within the 'action' parameter of the /uapi-cgi/instantrec.cgi page of Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx, EFD-22xx, ETHC-22xx, and EWPC-22xx devices running firmware versions equal to 1.12.0.27 as well as firmware versions 1.12.13.2 and[…]

Geutebruck Remote Command Execution

CGI Files ≈ Packet Storm Sep 2, 2021 | 15:36 pm

This Metasploit module bypasses the HTTP basic authentication used to access the /uapi-cgi/ folder and exploits multiple authenticated arbitrary command execution vulnerabilities within the parameters of various pages on Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx, EFD-22xx, ETHC-22xx, and EWPC-22xx devices[…]

IPFire 2.25 Remote Code Execution

CGI Files ≈ Packet Storm Jun 15, 2021 | 15:18 pm

This Metasploit module exploits an authenticated command injection vulnerability in the /cgi-bin/pakfire.cgi web page of IPFire devices running versions 2.25 Core Update 156 and prior to execute arbitrary code as the root user.

Ubuntu Security Notice USN-4886-1

CGI Files ≈ Packet Storm Mar 23, 2021 | 16:33 pm

Ubuntu Security Notice 4886-1 - It was discovered that Privoxy incorrectly handled CGI requests. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. It was discovered that Privoxy incorrectly handled certain regular[…]

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Unauthenticated Configuration Download

CGI Files ≈ Packet Storm Mar 19, 2021 | 16:52 pm

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE version 2.0.1 is susceptible to an unauthenticated configuration disclosure when direct object reference is made to the export_settings.cgi file using an HTTP GET request. This will enable the attacker to disclose sensitive information and help[…]

Cisco UCS Manager 2.2(1d) Remote Command Execution

CGI Files ≈ Packet Storm Jan 18, 2021 | 15:47 pm

Cisco UCS Manager version 2.2(1d) remote command execution exploit. An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote[…]

ZeroShell 3.9.0 Remote Command Execution

CGI Files ≈ Packet Storm Nov 24, 2020 | 15:34 pm

This Metasploit module exploits an unauthenticated command injection vulnerability found in ZeroShell version 3.9.0 in the "/cgi-bin/kerbynet" url. As sudo is configured to execute /bin/tar without a password (NOPASSWD) it is possible to run root commands using the "checkpoint" tar[…]

ASUS TM-AC1900 Arbitrary Command Execution

CGI Files ≈ Packet Storm Nov 13, 2020 | 16:00 pm

This Metasploit module exploits a code execution vulnerability within the ASUS TM-AC1900 router as an authenticated user. The vulnerability is due to a failure filter out percent encoded newline characters within the HTTP argument SystemCmd when invoking /apply.cgi which bypasses[…]

D-Link DSR-250N Denial Of Service

CGI Files ≈ Packet Storm Oct 8, 2020 | 16:50 pm

RedTeam Pentesting discovered a denial of service vulnerability in the D-Link DSR-250N device which allows unauthenticated attackers in the same local network to execute a CGI script that reboots the device. Version 3.12 is confirmed affected.

Share This

Follow Us