admin/GobyVuls
1
0
Fork 0
mirror of https://github.com/gobysec/GobyVuls.git synced 2025-05-05 10:16:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
GobyVuls/KlogServer/CVE-2020-35729
History
corp0ra1 d20e71a9d6
add CVE-2020-35729
2021-08-02 14:45:40 +08:00
..
CVE_2020_35729.gif
add CVE-2020-35729
2021-08-02 14:45:40 +08:00
README.md
add CVE-2020-35729
2021-08-02 14:45:40 +08:00

README.md

Klog Server Unauth RCE(CVE-2020-35729)

The 'authenticate.php' file uses the 'user' HTTP POST parameter in a call to the 'shell_exec()' PHP function without appropriate input validation,allowing arbitrary command execution as the apache user.

Affected Version: ≤2.4.1

FOFA query rule: title="KLog Server" && body="authenticate.php"

Demo