CVE-2020-36924

MEDIUM

Sony BRAVIA Digital Signage 1.7.8 - RCE

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-36924. PoCs published by LiquidWorm.

AI-analyzed exploit summary This exploit demonstrates an unauthenticated remote file inclusion (RFI) vulnerability in Sony BRAVIA Digital Signage 1.7.8. It allows arbitrary client-side script inclusion via a crafted POST request to the content-creation API endpoint.

Description

Sony BRAVIA Digital Signage 1.7.8 contains a remote file inclusion vulnerability that allows attackers to inject arbitrary client-side scripts through the content material URL parameter. Attackers can exploit this vulnerability to hijack user sessions, execute cross-site scripting code, and modify display content by manipulating the input material type.

Exploits (1)

exploitdb WORKING POC

by LiquidWorm · textwebappshardware

https://www.exploit-db.com/exploits/49186

View Code ZIP pw:eip

This exploit demonstrates an unauthenticated remote file inclusion (RFI) vulnerability in Sony BRAVIA Digital Signage 1.7.8. It allows arbitrary client-side script inclusion via a crafted POST request to the content-creation API endpoint.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Sony BRAVIA Digital Signage <=1.7.8

No auth needed

Prerequisites: Network access to the target system · Target system running vulnerable Sony BRAVIA Digital Signage software

MITRE ATT&CK