Lucene search
PRIOn knowledge basePRION:CVE-2020-26124HistoryOct 02, 2020 - 9:15 a.m.
Code injection
2020-10-0209:15:00
PRIOn knowledge base
www.prio-n.com
3
openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating system as root.
| CPE | Name | Operator | Version |
|---|---|---|---|
| openmediavault | ge | 5.0.0 | |
| openmediavault | lt | 5.5.12 | |
| openmediavault | lt | 4.1.36 |
Related
openvas
openvas
nvd
nvd
CVE-2020-26124
2020-10-02 09:15:13
packetstorm
packetstorm
OpenMediaVault rpc.php Authenticated PHP Code Injection
2020-11-25 00:00:00
osv
osv
CVE-2020-26124
2020-10-02 09:15:13
cvelist
cvelist
CVE-2020-26124
2020-10-02 08:28:03
cve
cve
CVE-2020-26124
2020-10-02 09:15:13
zdt
zdt
OpenMediaVault rpc.php Authenticated PHP Code Injection Exploit
2020-11-25 00:00:00
rapid7blog
rapid7blog
Metasploit Wrap-Up
2020-11-27 16:22:44