CVE-2020-28188

Related Files

TerraMaster TOS 4.2.06 Remote Code Execution

Posted Jun 12, 2023

Authored by IHTeam, h00die-gr3y | Site metasploit.com

This Metasploit module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS versions 4.2.06 and below via shell metacharacters in the Event parameter at vulnerable endpoint include/makecvs.php during CSV creation. Any unauthenticated user can therefore execute commands on the system under the same privileges as the web application, which typically runs under root at the TerraMaster Operating System.

tags | exploit, remote, web, shell, root, php, code execution

advisories | CVE-2020-28188, CVE-2020-35665

SHA-256 | 8935d1e9f61d6f9eb3550ec44e1a8a5d97992b91e55a7456ae2af009097db539

Download | Favorite | View