PT-2022-12279 · Unknown · Quickbox Pro

Websecnl · Published 2022-01-24 · Updated 2022-07-12 · CVE-2021-44981

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QuickBox Pro versions 2.5.8 and below

Description The issue allows for remote code execution due to a variable in the config.php file that takes a GET parameter value and parses it into a shell exec() function without properly sanitizing shell arguments. As the media server runs as root by default, attackers can use the sudo command within this shell exec() function, enabling privilege escalation through remote code execution.

Recommendations For versions 2.5.8 and below, consider disabling the shell exec() function in the config.php file until a patch is available to prevent remote code execution. Restrict access to the config.php file to minimize the risk of exploitation. Avoid using the sudo command within the shell exec() function in the affected versions.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-44981

Affected Products

Quickbox Pro

References · 5

• 🔥 https://websec.nl/blog/61b2b37a43a1155c848f3b08/websec%20finds%20critical%20vulnerabilities%20in%20popular%20media%20server · Exploit
• https://osv.dev/vulnerability/CVE-2021-44981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44981 · Security Note
• https://github.com/QuickBox/QB/issues/202 · Note
• https://t.me/cibsecurity/36123 · Telegram Post