CVE-2020-15568

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

28.98% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-913

Published

2021-01-30

Updated

2024-08-04

Proof-of-concept exploits (2)

• divinepwner/TerraMaster-TOS-CVE-2020-155683★ · 2023-02-21
• n0bugz/CVE-2020-155682★ · 2022-10-23

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15568.yaml

Exploit collections (2)

• terramaster-cve-2020-15568.ymlchaitin/xray
• CVE-2020-15568.yamlzan8in/afrog

Security advisories

• https://help.terra-master.com/TOS/view
• https://ssd-disclosure.com/ssd-advisory-terramaster-os-exportuser-php-remote-code-executi…

References

• CVE Record
• NVD entry