This is a vulnerability writeup describing a remote code execution flaw in the USB & Wi-Fi Flash Drive v1.3 iOS mobile web application. The vulnerability is located in the 'name' parameter of the 'cgi/newfolder/' function, allowing arbitrary code execution via GET requests without authentication.
Classification
Writeup 90%
Target:
USB & Wi-Fi Flash Drive - iOS Mobile Web Application (Wifi) 1.3
No auth needed
Prerequisites:
Network access to the vulnerable iOS application · Ability to send crafted GET requests