CVE-2020-15568

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

28.98% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-913

Published

2021-01-30

Updated

2024-08-04

Proof-of-concept exploits (2)

• divinepwner/TerraMaster-TOS-CVE-2020-155683★ · 2023-02-21
• n0bugz/CVE-2020-155682★ · 2022-10-23

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15568.yaml

Exploit collections (2)

• chaitin/xray/blob/master/pocs/terramaster-cve-2020-15568.yml
• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2020/CVE-2020-15568.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2020-15540
• CVE-2020-15570
• CVE-2020-15539
• CVE-2020-15588
• CVE-2020-15538
• CVE-2020-15589