← back
CVE-2018-11510

CVE-2018-11510

EPSS 44.8%
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter.
Affected products
n/a · n/a
public PoCs found — 6
githubgithub.com/mefulton/CVE-2018-11510★ 0cve_referencepacketstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.htmlunverifiedcve_referencewww.exploit-db.com/exploits/45212/unverifiedexploitdbwww.exploit-db.com/exploits/45200unverifiedexploitdbwww.exploit-db.com/exploits/45212unverifiedcve_referencewww.exploit-db.com/exploits/45200/unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.htmlhttps://github.com/mefulton/CVE-2018-11510https://github.com/mefulton/CVE-2018-11510/blob/master/admex.pyhttps://www.exploit-db.com/exploits/45200/https://www.exploit-db.com/exploits/45212/