CVE-2020-35729
CRITICAL NUCLEIklog_server 2.4.1 - OS Command Injection via User Parameter
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2020-35729.
PoCs published by Metin Yunus Kandemir, B3KC4T, Al1ex, including Metasploit module exploits/linux/http/klog_server_authenticate_user_unauth_command_injection.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated command injection vulnerability in Klog Server <= 2.4.1 via the 'user' parameter, which is passed to shell_exec() without validation. It includes a check for vulnerability and executes a command stager for payload delivery.
Description
KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.
Exploits (4)
This Metasploit module exploits an unauthenticated command injection vulnerability in Klog Server <= 2.4.1 via the 'user' parameter, which is passed to shell_exec() without validation. It includes a check for vulnerability and executes a command stager for payload delivery.
This exploit demonstrates an unauthenticated command injection vulnerability in Klog Server 2.4.1 by injecting a reverse shell payload into the 'user' parameter of a POST request to the authentication endpoint.
This repository contains a functional Python exploit for CVE-2020-35729, an unauthenticated command injection vulnerability in Klog Server 2.4.1. The exploit sends a crafted payload via HTTP POST to the authenticate.php endpoint, achieving remote code execution.
This Metasploit module exploits an unauthenticated command injection vulnerability in Klog Server's `authenticate.php` via the `user` POST parameter, leveraging `shell_exec()` without input validation. It achieves RCE as the apache user and escalates to root via sudo misconfiguration.
Nuclei Templates (1)
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H