.. / CVE-2020-15568

Exploit for TerraMaster TOS <.1.29 - Remote Code Execution (CVE-2020-15568)

Description:

TerraMaster TOS before 4.1.29 has invalid parameter checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.

Nuclei Template

View the template here CVE-2020-15568.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-15568.yaml
Copy

References:

https://github.com/n0bugz/CVE-2020-15568
https://nvd.nist.gov/vuln/detail/CVE-2020-15568
https://help.terra-master.com/TOS/view/
https://github.com/divinepwner/TerraMaster-TOS-CVE-2020-15568
https://ssd-disclosure.com/ssd-advisory-terramaster-os-exportuser-php-remote-code-execution/