CVE-2021-45420 PoC — Emerson Xweb-500 授权问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/dixell-xweb500-filewrite.yaml

Associated Vulnerability

Title:Emerson Xweb-500 授权问题漏洞 (CVE-2021-45420)
Description:Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced

Description

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerabilities in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note that this product has not been supported since 2018 and should be removed or replaced.

File Snapshot


 id: dixell-xweb500-filewrite

info:
  name: Emerson Dixell XWEB-500 - Arbitrary File Write
  author:

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!