ID:5974 - Exploit for OS command injection in NUUO NVRmini 2 - CVE-2018-15716

Link to public exploit:

Vulnerability description

The vulnerability allows a remote authenticated attacker to execute arbitrary shell commands on the target system.

The vulnerability exists in upgrade_handle.php due to insufficient validation of user-supplied input. A remote authenticated attacker can send specially crafted requests containing shell metacharacters in the uploaddir parameter for a writeuploaddir command to bypass the uploaddir filter and execute OS commands with root privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: the vulnerability exists due to insufficient patch for CVE-2018-14933.

Remediation