CVE-2024-37770

CVE-2024-37770 description 14Finger v1.1 被发现其指纹功能中存在远程命令执行（RCE）漏洞。该漏洞允许攻击者通过构造的有效载荷执行任意命令。 Attack Vector 未认证的攻击者可通过 shell 元字符执行命令注入，从而实现对远程服务器的 RCE。 Detail 核心功能的指纹扫描点存在未授权的远程命令执行漏洞 通过审计源代码，可以看到当 onlyspider 为 false、spider 为 true 时，将执行 crawlsite 函数 继续跟进，发现提交的 URL 会被拼接到 CMD 中，交给 Python 的 subprocess...

CVE-2024-37770

14Finger v1.1 was discovered to contain a remote command execution RCE vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload...

CVE-2024-37770

14Finger v1.1 was discovered to contain a remote command execution RCE vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload...

CVE-2024-37770

CVE-2024-37770 affects 14Finger v1.1, with a Remote Command Execution (RCE) vulnerability in the fingerprint function that allows an attacker to run arbitrary commands via a crafted payload. The CVSSv3.1 base score is 9.1 (CRITICAL) with network access, low attack complexity, no privileges requir...

CVE-2024-37770

14Finger v1.1 was discovered to contain a remote command execution RCE vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload...

CVE-2024-37770

14Finger v1.1 was discovered to contain a remote command execution RCE vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload...

PT-2024-27742 · 14Finger · 14Finger

Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: The issue is related to a remote command execution RCE vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload. Recommendations: For...