CVE-2021-44981
In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without properly sanitizing any shell arguments, therefore remote code execution is possible.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without properly sanitizing any shell arguments, therefore remote code execution is possible. Additionally, as the media server is running as root by default attackers can use the sudo command within this shell_exec(''); function, which allows for privilege escalation by means of RCE.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.67% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- quickbox/quickbox
- Source
- cve@mitre.org
References
- https://github.com/QuickBox/QB/issues/202Issue Tracking, Third Party Advisory
- https://websec.nl/blog/61b2b37a43a1155c848f3b08/websec%20finds%20critical%20vulnerabilities%20in%20popular%20media%20serverExploit, Third Party Advisory
- https://github.com/QuickBox/QB/issues/202Issue Tracking, Third Party Advisory
- https://websec.nl/blog/61b2b37a43a1155c848f3b08/websec%20finds%20critical%20vulnerabilities%20in%20popular%20media%20serverExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.