QNAP - pingping.cgi RCE Detection (CVE-2013-0143)

Detects CVE-2013-0143 by requesting /cgi-bin/pingping.cgi?pingip=1;id; with Basic guest:guest or without auth. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP pingping.cgi command injection CVE-2013-0143.""" import base64 import re from kittysploit import from lib.protocols.http.httpclient impo...

QNAP - pingping.cgi Command Injection (CVE-2013-0143)

Exploits CVE-2013-0143 via /cgi-bin/pingping.cgi?pingip=1;;. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP pingping.cgi RCE CVE-2013-0143 — opens execute session.""" import base64 import re from urllib.parse import quote from kittysploit import from...

PT-2013-2129

Name of the Vulnerable Software and Affected Versions QNAP VioStor NVR devices version 4.0.3 QNAP NAS affected versions not specified, specifically in the Surveillance Station Pro component Description The issue allows remote authenticated users to execute arbitrary commands. This is achieved by...

CVE-2013-0143: Improper Control of Generation of Code

cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string...