CVE-2020-35729
critical · 9.8A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.
9.8
CVSS
88.1%
EPSS (exploit prob.)
100th
EPSS percentile
2020-12-27
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| klogserver | klog_server | 2.4.1 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/160798/Klog-Server-2.4.1-Command-Injection.html
- http://packetstormsecurity.com/files/161123/Klog-Server-2.4.1-Command-Injection.html
- http://packetstormsecurity.com/files/161410/Klog-Server-2.4.1-Command-Injection.html
- https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/Exploit_Code
- https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/README.md
- http://packetstormsecurity.com/files/160798/Klog-Server-2.4.1-Command-Injection.html
- http://packetstormsecurity.com/files/161123/Klog-Server-2.4.1-Command-Injection.html
- http://packetstormsecurity.com/files/161410/Klog-Server-2.4.1-Command-Injection.html
- https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/Exploit_Code
- https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/README.md
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-35729