CVE-2020-35729

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Klog Server 2.4.1 - Unauthenticated Command Injection (Metasploit)2021-01-25 · webapps · php · Verified
• Klog Server 2.4.1 - Command Injection (Unauthenticated)2021-01-05 · webapps · php · Verified

Impact

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://packetstormsecurity.com/files/160798/Klog-Server-2.4.1-Command-Injection.html
• http://packetstormsecurity.com/files/161123/Klog-Server-2.4.1-Command-Injection.html
• http://packetstormsecurity.com/files/161410/Klog-Server-2.4.1-Command-Injection.html
• https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/Exploit_Code
• https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/README.md
• http://packetstormsecurity.com/files/160798/Klog-Server-2.4.1-Command-Injection.html
• http://packetstormsecurity.com/files/161123/Klog-Server-2.4.1-Command-Injection.html
• http://packetstormsecurity.com/files/161410/Klog-Server-2.4.1-Command-Injection.html
• https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/Exploit_Code
• https://github.com/mustgundogdu/Research/blob/main/KLOG_SERVER/README.md