CVE-2020-23591 PoC — Optilink Network OP-XT71000N 代码问题漏洞

Source

Associated Vulnerability

Description

ARBITAR FILE UPLOAD LEADS TO "delete every file for Denial of Service (using 'rm -rf *.*' in the code), reverse connection (using '.asp' webshell), backdoor , Escalation of Privileges, etc".

Readme

# CVE-2020-23591

**OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OP_V3.3.1-191028"**  

Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028" which allows an attacker to upload arbitrary file through " /mgm_dev_upgrade.asp " which can "delete every file for Denial of Service (using 'rm -rf *.*' in the code), reverse connection (using '.asp' webshell), backdoor , Escalation of Privileges, etc".

**TARGET**

/mgm_dev_upgrade.asp


**Attack Vector**

upload arbitrary file through " /mgm_dev_upgrade.asp " which leads to "delete every file for Denial of Service (using 'rm -rf *.*' in the code), reverse connection (using '.asp' webshell), backdoor , Escalation of Privileges, etc".


**REGARDS**

Huzaifa Hussain

https://twitter.com/disguised_noob

https://www.linkedin.com/in/huzaifa-hussain-046791179

File Snapshot

 [4.0K]  /data/pocs/26a096d4a7b5d96d9d72a10301f834565e37b27e
└── [ 908]  README.md

0 directories, 1 file

Remarks