CVE-2024-22107

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22107
An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php is vulnerable to command injection via the /old/react/v1/api/system/dns/data endpoint. An authenticated attacker can abuse it to inject an arbitrary command and compromise the platform.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://adepts.of0x.cc/gtbcc-pwned/ Exploit Third Party Advisory
https://x-c3ll.github.io/cves.html Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:gttb:gtb_central_console:15.17.1-30814.ng:*:*:*:*:*:*:*
History

09 Feb 2024, 19:44

Type Values Removed Values Added
First Time Gttb gtb Central Console
Gttb
References () https://adepts.of0x.cc/gtbcc-pwned/ - () https://adepts.of0x.cc/gtbcc-pwned/ - Exploit, Third Party Advisory
References () https://x-c3ll.github.io/cves.html - () https://x-c3ll.github.io/cves.html - Exploit
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.2
CWE CWE-77
Summary
  • (es) Se descubrió un problema en GTB Central Console 15.17.1-30814.NG. El método systemSettingsDnsDataAction en /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php es vulnerable a la inyección de comandos a través del endpoint /old/react/v1/api/system/dns/data. Un atacante autenticado puede abusar de él para inyectar un comando arbitrario y comprometer la plataforma.
CPE cpe:2.3:a:gttb:gtb_central_console:15.17.1-30814.ng:*:*:*:*:*:*:*

02 Feb 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-02 16:15

Updated : 2024-02-09 19:44

NVD link : CVE-2024-22107

Mitre link : CVE-2024-22107

CVE.ORG link : CVE-2024-22107

JSON object : View

Products Affected

gttb

  • gtb_central_console
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')