.. / CVE-2020-35729

• RCE
• Nuclei
• Web

Exploit for Klog Server <=2.41 - Unauthenticated Command Injection (CVE-2020-35729)

Description:

Klog Server 2.4.1 and prior is susceptible to an unauthenticated command injection vulnerability. The authenticate.php file uses the user HTTP POST parameter in a call to the shell_exec() PHP function without appropriate input validation, allowing arbitrary command execution as the apache user. The sudo configuration permits the Apache user to execute any command as root without providing a password, resulting in privileged command execution as root. Originated from Metasploit module, copyright (c) space-r7.

Nuclei Template

View the template here CVE-2020-35729.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-35729.yaml

References: