Description
QNAP QTS存在命令注入漏洞，此漏洞是由于quick.cgi接口对用户的请求验证不当导致的。
QNAP QTS CVE-2023-47218 命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.tenablecloud.cn/plugins/nessus/190555
https://avd.aliyun.com/detail?id=AVD-2023-47218
https://www.nsfocus.net/vulndb/100064
https://cve.imfht.com/detail/CVE-2023-47218
https://github.com/passwa11/CVE-2023-47218
https://nvd.nist.gov/vuln/detail/cve-2023-47218
https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/
https://www.qnap.com/en-us/security-advisory/qsa-23-57
https://www.idappcom.co.uk/post/qnap-qts-and-quts-hero-unauthenticated-command-injection-cve-2023-47218
https://advisories.checkpoint.com/defense/advisories/public/2024/cpai-2023-1695.html
https://pentest-tools.com/vulnerabilities-exploits/qnap-qts-and-quts-hero-os-command-injection_22608
https://www.helpnetsecurity.com/2024/02/14/cve-2023-47218-cve-2023-50358/
https://asec.ahnlab.com/en/79724/
https://threatprotect.qualys.com/2024/02/16/qnap-qts-os-command-injection-vulnerabilities-cve-2023-47218-cve-2023-50358/
https://socprime.com/blog/cve-2023-50358-detection-a-new-zero-day-vulnerability-in-qnap-qts-and-quts-hero-firmware/
https://attackerkb.com/topics/DpINF4OQXY/cve-2023-47218