Vulnerability · Published Dec 27, 2020 · Assigned by mitre
CVE-2020-35729
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 88.1% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)88.1%top 0.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling3Metasploit, Nuclei, Public PoC
Official description
KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.
Affected products (as reported)
References
- https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/README.md x_refsource_MISC
- https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/Exploit_Code x_refsource_MISC
- http://packetstormsecurity.com/files/160798/Klog-Server-2.4.1-Command-Injection.html x_refsource_MISC
- http://packetstormsecurity.com/files/161123/Klog-Server-2.4.1-Command-Injection.html x_refsource_MISC
- http://packetstormsecurity.com/files/161410/Klog-Server-2.4.1-Command-Injection.html x_refsource_MISC