Displaying items by tag: perl

Cayin CMS NTP Server 11.0 Remote Code Execution

CGI Files ≈ Packet Storm Jun 18, 2020 | 16:04 pm

This Metasploit module exploits an authenticated remote code execution vulnerability in Cayin CMS versions 11.0 and below. The code execution is executed in the system_service.cgi file's ntpIp Parameter. The field is limited in size, so repeated requests are made to[…]

Cayin Content Management Server 11.0 Root Remote Command Injection

CGI Files ≈ Packet Storm Jun 4, 2020 | 19:29 pm

CAYIN CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the NTP_Server_IP HTTP POST parameter in system.cgi page.

Cayin Signage Media Player 3.0 Root Remote Command Injection

CGI Files ≈ Packet Storm Jun 4, 2020 | 19:26 pm

CAYIN SMP-xxxx suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the NTP_Server_IP HTTP GET parameter in system.cgi and wizard_system.cgi pages.

Secure Computing SnapGear Management Console SG560 3.1.5 Arbitrary File Read / Write

CGI Files ≈ Packet Storm Jun 4, 2020 | 16:43 pm

Secure Computing SnapGear Management Console SG560 version 3.1.5 suffers from arbitrary file read and write vulnerabilities. The application allows the currently logged-in user to edit the configuration files in the system using the CGI executable edit_config_files in /cgi-bin/cgix/. The files[…]

Synology DiskStation Manager smart.cgi Remote Command Execution

CGI Files ≈ Packet Storm May 22, 2020 | 19:03 pm

This Metasploit module exploits a vulnerability found in Synology DiskStation Manager (DSM) versions prior to 5.2-5967-5, which allows the execution of arbitrary commands under root privileges after website authentication. The vulnerability is located in webman/modules/StorageManager/smart.cgi, which allows appending of a[…]

Ubuntu Security Notice USN-4356-1

CGI Files ≈ Packet Storm May 13, 2020 | 14:26 pm

Ubuntu Security Notice 4356-1 - Jeriko One discovered that Squid incorrectly handled certain Edge Side Includes responses. A malicious remote server could cause Squid to crash, possibly poison the cache, or possibly execute arbitrary code. It was discovered that Squid[…]

Zen Load Balancer 3.10.1 Directory Traversal

CGI Files ≈ Packet Storm Apr 23, 2020 | 19:32 pm

This Metasploit module exploits an authenticated directory traversal vulnerability in Zen Load Balancer version 3.10.1. The flaw exists in index.cgi not properly handling the filelog= parameter which allows a malicious actor to load arbitrary file path.

D-Link DIR-859 Unauthenticated Remote Command Execution

CGI Files ≈ Packet Storm Jan 22, 2020 | 16:26 pm

D-Link DIR-859 Routers are vulnerable to OS command injection via the UPnP interface. The vulnerability exists in /gena.cgi (function genacgi_main() in /htdocs/cgibin), which is accessible without credentials.

Barco WePresent file_transfer.cgi Command Injection

CGI Files ≈ Packet Storm Jan 14, 2020 | 16:16 pm

This Metasploit module exploits an unauthenticated remote command injection vulnerability found in Barco WePresent and related OEM'ed products. The vulnerability is triggered via an HTTP POST request to the file_transfer.cgi endpoint.

Rifatron Intelligent Digital Security System (animate.cgi) Stream Disclosure

CGI Files ≈ Packet Storm Sep 9, 2019 | 23:46 pm

The Rifatron Intelligent Digital Security System DVR suffers from an unauthenticated and unauthorized live stream disclosure when animate.cgi script is called through Mobile Web Viewer module.

Share This

Follow Us