Asustor ADM music.cgi act=live command injection RCE

Login → upload malicious .mp3 filename → act=add → act=live triggers ffmpeg -i "..." shell breakout command in filename. """Asustor ADM music.cgi act=live authenticated command injection RCE.""" from future import annotations import json import re import uuid from urllib.parse import urlencode fr...

Asustor ADM 3.5.9 (AS602T) — Post-Authentication Command Injection in `music.cgi — Detect

Fingerprint / reachability check for Asustor ADM 3.5.9 AS602T — Post-Authentication Command Injection in music.cgi act=live → Command Execution in the CGI Process !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Asustor ADM 3.5.9 AS602T — Post-Authentication Command Injection in music.c...