github.comexploit
https://github.com/willchen0011/cve/blob/main/rce.md CVE-2023-6895
MEDIUMNuclei
Hikvision Intercom Broadcasting System ping.php os command injection
Record summary
CVE-2023-6895 has a selected CVSS score of 6.3 (medium); EIP currently links 2 repository PoCs and 1 Nuclei template.
Description
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.
Description source: CVE List
Exploitation context
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Intercom Broadcasting SystemBrowse Hikvision / Intercom Broadcasting System | CVE List | 3.0.3_20201113_RELEASE(HIK) | affected |
intercom_broadcast_systemBrowse Hikvision / intercom_broadcast_system | VulnCheck | Version data not supplied | |
Proofs of concept
2Repository PoCs
GitHubFuBoLuSec/CVE-2023-6895Repository PoCby FuBoLuSecStars: 1Not analyzed2 files
GitHubnles-crt/CVE-2023-6895Repository PoCby nles-crtStars: 0Not analyzed2 files
Nuclei templates
1ProjectDiscoveryCRITICALHikvision IP ping.php - Command ExecutionCVSS 9.8
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.
Impact
Unauthenticated attackers can execute arbitrary operating system commands via the jsondata[ip] parameter, potentially gaining complete control over the Hikvision Intercom Broadcasting System.
Remediation
Upgrade to Hikvision Intercom Broadcasting System version 4.1.0 or later.
WeaknessesCWE-78
AuthorsDhiyaneshDk, archer
Template tagscvecve2023hikvisionrcevulnvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:o:hikvision:intercom_broadcast_system:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:"-1830859634"
FOFA: icon_hash="-1830859634"
https://vuldb.com/?ctiid.248254 https://vuldb.com/?id.248254 https://github.com/tanjiti/sec_profile https://github.com/wy876/POC https://github.com/xingchennb/POC-
Source: ProjectDiscovery
References
4nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-6895 vuldb.comsignaturepermissions required
https://vuldb.com/?ctiid.248254 vuldb.comvdb entryTechnical description
https://vuldb.com/?id.248254