nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-7066 CVE-2024-7066
MEDIUM
F-logic DataCube3 HTTP POST Request config_time_sync.php os command injection
Record summary
CVE-2024-7066 has a selected CVSS score of 6.9 (medium).
Description
A vulnerability was found in F-logic DataCube3 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/config_time_sync.php of the component HTTP POST Request Handler. The manipulation of the argument ntp_server leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272347.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 24, 2024 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
DataCube3Browse F-logic / DataCube3Default status: unknown | CVE List | 1.0 | affected |
References
5VDB-272347 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions required
https://vuldb.com/?ctiid.272347 VDB-272347 | F-logic DataCube3 HTTP POST Request config_time_sync.php os command injectionvdb entryTechnical description
https://vuldb.com/?id.272347 Submit #378322 | F-logic DataCube3 v1.0 Command InjectionThird-party advisory
https://vuldb.com/?submit.378322 wiki.shikangsi.comexploit
https://wiki.shikangsi.com/post/share/17dfab05-2c50-4437-afa7-ef1f5a1f43f8