DroboPix - demo API Command Injection (CVE-2018-14706)

Exploits DroboPix JSON injection in /DroboPix/api/drobopix/demo by writing command output under the DroboPix www tree. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """DroboPix demo API command injection CVE-2018-14706 — opens execute session.""" import re import...

DroboPix - demo API Command Injection Detection (CVE-2018-14706)

Detects DroboPix RCE by injecting into /DroboPix/api/drobopix/demo JSON enabled field, writing id output under /DroboPix/, then reading it. !/usr/bin/env python3 -- coding: utf-8 -- """DroboPix demo API command injection CVE-2018-14706.""" import re import secrets from kittysploit import from...

Drobo DroboPix Detection

Detection of Drobo DroboPix. The script sends a connection request to the server and attempts to detect Drobo DroboPix, s a one-click photo upload solution for mobile devices on Drobo NAS devices. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...

Drobo NAS Multiple Vulnerabilities in DroboPix

Drobo NAS are prone to multiple vulnerabilities in DroboPix. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Drobo 5N2 System Command Injection Vulnerability

The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. A command injection vulnerability exists in the /DroboPix/api/drobopix/demo endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115. An attacker...

CVE-2018-14702

Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

CVE-2018-14702

CVE-2018-14702 describes an improper access control in the Drobo 5N2 NAS, specifically the /drobopix/api/drobo.php endpoint used by DroboPix. Affects Drobo 5N2 NAS version 4.0.5-13.28.96115. An unauthenticated attacker can retrieve sensitive system information due to this access-control flaw. CVS...

PT-2018-12677

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns system command injection in the "/DroboPix/api/drobopix/demo" endpoint, allowing unauthenticated attackers to execute system commands via the payload in a POST request...

CVE-2018-14706: Improper Neutralization of Special Elements used in an OS Command

System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the payload in a POST request...

PT-2018-12674

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns incorrect access control in the "/drobopix/api/drobo.php" endpoint, allowing unauthenticated attackers to retrieve sensitive system information. Recommendations For Drobo 5...