CVE-2020-37123
CRITICAL EXPLOITED NUCLEIPinger 1.0 - Remote Code Execution via Ping and Socket Parameter Injection
Title source: llmExploitation Summary
CVE-2020-37123 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Milad karimi. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a command injection vulnerability in Pinger 1.0, where the 'ping' and 'socket' GET parameters are passed unsanitized to shell_exec(), allowing arbitrary command execution. The PoC shows how to write a PHP file to the server via command injection.
Description
Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.
Exploits (1)
This exploit demonstrates a command injection vulnerability in Pinger 1.0, where the 'ping' and 'socket' GET parameters are passed unsanitized to shell_exec(), allowing arbitrary command execution. The PoC shows how to write a PHP file to the server via command injection.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H