CVE-2020-22000
HIGHHomeAutomation 3.3.2 - Authenticated OS Command Injection via Custom Command Plugin
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-22000. PoCs published by LiquidWorm.
AI-analyzed exploit summary This exploit demonstrates a CSRF-based remote command execution vulnerability in HomeAutomation 3.3.2 via unsanitized input to the 'set_command_on' parameter, which is passed to PHP's exec() function. The PoC includes a reverse shell payload to achieve RCE as the web user.
Description
HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'set_command_on' and 'set_command_off' POST parameters in '/system/systemplugins/customcommand/customcommand.plugin.php' by using an unsanitized PHP exec() function.
Exploits (1)
This exploit demonstrates a CSRF-based remote command execution vulnerability in HomeAutomation 3.3.2 via unsanitized input to the 'set_command_on' parameter, which is passed to PHP's exec() function. The PoC includes a reverse shell payload to achieve RCE as the web user.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H