admin/GobyVuls
1
0 Fork 0
mirror of https://github.com/gobysec/GobyVuls.git synced 2026-10-27 19:10:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

add : CVE-2019-9653

Browse Source
This commit is contained in:
gaopeng2 committed 2022-05-13 12:00:44 +08:00
1 parent 844c1d5806
commit 5920ceace1
2 files changed
+10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Nuuo/CVE-2019-9653/NUUO_Network_Video_handle_load_config_php_Unauth_Command_Execution_vulnerability_CVE_2019_9653.gif
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 996 KiB

Nuuo/CVE-2019-9653/README.md
+10
View File
@@ -0,0 +1,10 @@
# NUUO Network Video handle_load_config.php Unauth Command Execution vulnerability(CVE-2019-9653)
NUUO Inc. is a company providing a video-centric surveillance solution. They have many NVR (Network Video Recorder) products for different customers with various requirements. These NVRs are Linux embedded video recording systems that can manage several cameras. Nowadays, they are used worldwide by many public institutions, companies, banks, or individuals, etc. The web interface of these NVR systems contains a lot of critical vulnerabilities can be abused by unauthenticated attackers. We discover that some vulnerable PHP scripts are lack of authentication mechanism and input protection thus they could be abused to achieve remote code execution on NUUO's devices as root.<br>
FOFA **query rule**: [body="NUUO"&&title="Network Video Recorder Login"](https://fofa.info/result?qbase64=Ym9keT0iTlVVTyImJnRpdGxlPSJOZXR3b3JrIFZpZGVvIFJlY29yZGVyIExvZ2luIg%3D%3D)
# Demo
![NUUO_Network_Video_handle_load_config_php_Unauth_Command_Execution_vulnerability_CVE_2019_9653](NUUO_Network_Video_handle_load_config_php_Unauth_Command_Execution_vulnerability_CVE_2019_9653.gif)