Description
An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation.
TerraMaster TOS < 4.2.07 未授权远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://security.zone.ci/aliyun/ali_nvd/105694.html
https://github.com/tzwlhack/Vulnerability/blob/main/TerraMaster%20TOS%20%E6%9C%AA%E6%8E%88%E6%9D%83%20RCE%20(CVE-2020-28188).md
https://qkl.seebug.org/vuldb/ssvid-99082
https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
https://www.exploit-db.com/exploits/49330
https://www.rapid7.com/db/vulnerabilities/terramaster-tos-cve-2020-28188/
https://avd.aliyun.com/detail?id=AVD-2020-35665
https://zhuanlan.zhihu.com/p/646400737
https://www.cdcxht.com/4/9516/1518427