jet-pentest/cve-2020-24032Proof-of-concept exploit for CVE-2020-24032: OS command injection in XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances via shell metacharacters in the timezone parameter.
[Suggested description]
tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone.
[VulnerabilityType Other]
OS command injection
[Vendor of Product]
XoruX s.r.o.
[Affected Product Code Base]
LPAR2RRD and STOR2RRD Virtual Appliance version - 2.70
[Attack Type]
Remote
[Impact Code execution]
true
[Has vendor confirmed or acknowledged the vulnerability?]
true
[Reference]
https://www.stor2rrd.com/download.php https://pastebin.com/G8981Fj8
[Discoverer]
Vsevolod Shamov (Jet Infosystems (jet.su), Moscow, Russia)
