cve/2018/CVE-2018-14933.md

CVE-2018-14933

Description

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

POC

Reference

• https://www.exploit-db.com/exploits/45070/
• https://www.exploit-db.com/exploits/46340/

Github

• https://github.com/20142995/Goby
• https://github.com/ARPSyndicate/cvemon
• https://github.com/HimmelAward/Goby_POC
• https://github.com/Z0fhack/Goby_POC