CVE-2021-46422

This exploit demonstrates an OS command injection vulnerability in Telesquare SDT-CW3B1 1.1.0 via the `admin.cgi` endpoint. It allows unauthenticated remote command execution by injecting commands into the `Cmd` parameter and parsing the XML response.

This exploit demonstrates an OS command injection vulnerability in SDT-CW3B1 1.1.0 via a crafted HTTP GET request to the admin.cgi endpoint. The 'Cmd' parameter is used to execute arbitrary system commands without authentication.

The repository contains two PoC scripts for different CVEs. The first script (CVE-2021-46422.py) targets a command injection vulnerability in a CGI endpoint, while the second (CVE-2022-26134.py) exploits an OGNL injection in Atlassian Confluence for RCE. Both scripts are functional and use the pocsuite3 framework.

This repository contains a functional exploit for CVE-2021-46422, an OS command injection vulnerability in Telesquare SDT-CW3B1 1.1.0. The exploit sends crafted requests to the admin.cgi endpoint to execute arbitrary commands and includes an interactive shell for post-exploitation.

This PoC exploits a remote code execution vulnerability in LYQ backend management by sending a crafted HTTP request to execute arbitrary commands via the 'sysCommand' parameter. The script checks for the presence of the vulnerability by verifying the response contains '<CmdResult>'.

This PoC exploits CVE-2021-46422, an OGNL injection vulnerability in Confluence Server and Data Center, allowing unauthenticated remote code execution. The script checks for the vulnerability by sending a crafted request to the target URL and verifying the response.

This PoC exploits CVE-2021-46422, a command injection vulnerability in Telesquare SDT-CW3B1 routers. It sends a crafted HTTP request to execute the 'id' command via the 'sysCommand' parameter without authentication.

This PoC exploits an OS command injection vulnerability in Telesquare SDT-CW3B1 1.1.0 by sending a crafted HTTP request to execute arbitrary commands. The script checks for vulnerability by injecting the 'id' command and verifying the response.

This PoC exploits an OS command injection vulnerability in Telesquare SDT-CW3B1 1.1.0 by sending a crafted HTTP request to execute arbitrary commands. The script checks for vulnerability by injecting the 'id' command and verifying the response.

This Python script exploits an OS command injection vulnerability in Telesquare SDT-CW3B1 1.1.0 via an unauthenticated CGI endpoint. It allows remote command execution by injecting commands into the 'Cmd' parameter and parsing XML responses.

This repository contains a functional exploit for CVE-2021-46422, an OS command injection vulnerability in Telesquare SDT-CW3B1 1.1.0. The exploit leverages a vulnerable CGI endpoint to execute arbitrary commands and includes both single-target and mass-exploitation capabilities.

This PoC exploits a command injection vulnerability in the LYQ router's admin interface via the `/cgi-bin/admin.cgi` endpoint, allowing unauthenticated remote code execution. The script uses the `pocsuite3` framework to verify and exploit the vulnerability by sending a crafted HTTP request with the `Command=sysCommand&Cmd=id` payload.

This PoC leverages the pocsuite3 framework to exploit a remote code execution vulnerability in LYQ's backend management system. It sends a crafted HTTP request to execute the 'id' command and checks for a specific response pattern to confirm vulnerability.

This PoC exploits an OS command injection vulnerability in SDT-CW3B1 routers via an unauthenticated endpoint. It sends a crafted request to execute arbitrary commands and checks for the presence of 'CmdResult' in the response to confirm exploitation.

This PoC exploits CVE-2021-46422, a command injection vulnerability in Korean wireless routers, by sending a crafted request to execute arbitrary commands via the 'sysCommand' parameter. The script uses the pocsuite3 framework to verify and exploit the vulnerability.

This PoC demonstrates an unauthenticated command injection vulnerability in Telesquare SDT-CW3B1 1.1.0, allowing remote command execution via a crafted HTTP request to the admin.cgi endpoint. The exploit uses the pocsuite3 framework to verify and exploit the vulnerability.