Description
Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.
TerraMaster TOS path 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/TerraMaster%20TOS%20createRaid%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2022-24989.md
https://security.zone.ci/aliyun/ali_nvd/105694.html
https://www.exploit-db.com/exploits/50635
https://www.sxxdckj.com/cms/a/TerraMaster-TOS-duo-ge-lou-dong-tong-gao.html
https://avd.aliyun.com/detail?id=AVD-2022-24989
https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
https://www.sentinelone.com/vulnerability-database/cve-2020-28188/
https://pwn.ai/blog/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation