CVE-2019-12988 PoC — Citrix Systems SD-WAN Center和NetScaler SD-WAN Center 命令操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12988.yaml

Associated Vulnerability

Title:Citrix Systems SD-WAN Center和NetScaler SD-WAN Center 命令操作系统命令注入漏洞 (CVE-2019-12988)
Description:Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6).

Description

Citrix SD-WAN Center is susceptible to remote command injection via the addModifyZTDProxy function in NmsController. The function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for ztd_password,  thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.

File Snapshot


 id: CVE-2019-12988

info:
  name: Citrix SD-WAN Center - Remote Command Injection
  author: gy741
  

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!