CVE-2018-14699

CVE-2018-14699 DroboAccess v2.1 中 enableuser 函数的无认证命令注入 使用方法： 首先启动一个监听器（ncat -nvlp 1337） 然后运行漏洞利用脚本 示例：exploit.py -t 192.168.1.122:8080 -l 192.168.1.2 -p 1337 '-t', '--target', help='用于利用的主机，例如 192.168.1.122:8080', required=True '-l', '--listener-ip', help='监听器 IP', required=True '-p', '--port',...

Drobo NAS Multiple Vulnerabilities in DroboAccess

Drobo NAS are prone to multiple vulnerabilities in DroboAccess. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...

Drobo DroboAccess Detection

Detection of Drobo DroboAccess. The script sends a connection request to the server and attempts to detect Drobo DroboAccess, a web interface for Drobo NAS devices. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C b...

Drobo 5N2 cross-site scripting vulnerability (CNVD-2019-05931)

The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. A cross-site scripting vulnerability exists in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115. A remote...

PT-2018-12669

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns cross-site scripting that allows attackers to execute JavaScript. This is possible via the "username" URL parameter in the /DroboAccess/delete user endpoint. Recommendation...

PT-2018-12668

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns cross-site scripting that allows attackers to execute JavaScript. This is achieved via the "username" variable in the "/DroboAccess/enable user" endpoint. Recommendations F...

CVE-2018-14699: Improper Neutralization of Special Elements used in an OS Command

System command injection in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...

PT-2018-12673

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns system command injection in the "/DroboAccess/delete user" endpoint, allowing unauthenticated attackers to execute system commands via the username URL parameter...

PT-2018-12670

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns system command injection in the "/DroboAccess/enable user" endpoint, allowing unauthenticated attackers to execute system commands. This is achieved via the username URL...