CVE-2020-35729 PoC — KLog Server 操作系统命令注入漏洞

Source

Associated Vulnerability

Description

Klog Server 2.4.1 and prior is susceptible to an unauthenticated command injection vulnerability. The `authenticate.php` file uses the `user` HTTP POST parameter in a call to the `shell_exec()` PHP function without appropriate input validation, allowing arbitrary command execution as the apache user. The sudo configuration permits the Apache user to execute any command as root without providing a password, resulting in privileged command execution as root. Originated from Metasploit module, copyright (c) space-r7.

File Snapshot

 id: CVE-2020-35729

info:
  name: Klog Server <=2.41 - Unauthenticated Command Injection
  author: d

...

Remarks