CVE-2024-22107

An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php is vulnerable to command injection via the /old/react/v1/api/system/dns/data endpoint. An authenticated attacker can abuse it to inject an arbitrary command and compromise the platform.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

2.53% chance of exploitation in the next 30 days, 84th percentile

Published

2024-02-02

Updated

2025-05-15

Proof-of-concept exploits (1)

• https://adepts.of0x.cc/gtbcc-pwned/

References

• CVE Record
• NVD entry

Related

• CVE-2024-22088
• CVE-2024-22108
• CVE-2024-22087
• CVE-2024-22120
• CVE-2024-22086
• CVE-2024-22145