CVE-2018-1207
CRITICAL EXPLOITED NUCLEIDell EMC iDRAC7/iDRAC8 < 2.52.52.52 - Unauthenticated Remote Code Execution via CGI Injection
Title source: llmExploitation Summary
CVE-2018-1207 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including Photubias, mgargiullo, theinkbit. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit targets CVE-2018-1207, an unauthenticated file upload vulnerability in Dell EMC iDRAC7/iDRAC8. It includes a checker and an exploit to add a webadmin user via a precompiled payload.
Description
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. A remote unauthenticated attacker may potentially be able to use CGI variables to execute remote code.
Exploits (4)
This exploit targets CVE-2018-1207, an unauthenticated file upload vulnerability in Dell EMC iDRAC7/iDRAC8. It includes a checker and an exploit to add a webadmin user via a precompiled payload.
This exploit targets a CGI injection vulnerability in Dell EMC iDRAC7/iDRAC8 firmware versions prior to 2.52.52.52 (CVE-2018-1207). It generates a shared object payload using a cross-compiler, uploads it to the vulnerable device, and triggers execution via LD_PRELOAD to achieve remote code execution as root.
This repository contains a functional Python exploit for CVE-2018-1207, targeting Dell iDRAC7/iDRAC8 devices with firmware versions prior to 2.52.52.52. The exploit leverages LD_PRELOAD to execute a reverse shell payload as root by uploading a malicious shared object file.
This repository contains a functional Python exploit for CVE-2018-1207, targeting Dell iDRAC7/iDRAC8 devices with firmware versions below 2.52.52.52. The exploit achieves remote code execution (RCE) as root by leveraging LD_PRELOAD to load a malicious shared object file, resulting in a reverse shell.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H