NUUO Crystal Server 3.19.0.85 allows unauthenticated PHP upload to RCE
Original title: [0day-rubbish] NUUO Crystal Server 3.19.0.85 unauthenticated upload.php PHP web-root write with fastcgi execution into server-side code execution as the web service account (9.8 Critical)
Uploaded PHP can execute through FastCGI as the web service account, rated 9.8 Critical.
0day Rubbish Research Team publicly disclosed an unauthenticated flaw in NUUO Crystal Server 3.19.0.85. The upload.php endpoint can write PHP into the web root, and lighttpd FastCGI dispatch to php-cgi turns that write into server-side code execution as the web service account. The team rates it 9.8 Critical. No fix or exploitation status is stated.
Unconfirmed: No patch, CVE, or confirmed in-the-wild exploitation is stated.
- The affected version is NUUO Crystal Server 3.19.0.85.
- The flaw is unauthenticated and involves upload.php.
- PHP requests are dispatched to /usr/bin/php-cgi.
- The software is distributed as an Ubuntu-based Crystal virtual-machine appliance.
Impact: unauthenticated server-side code execution as the web account
| Product | Affected |
|---|---|
| NUUO Crystal Server | 3.19.0.85 |
- Vendors
- NUUO
- Products
- Crystal Server
- Organizations
- 0day Rubbish Research Team
- Countries
- Taiwan
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 3.19.0.85 | publicly disclosing a vulnerability in NUUO Crystal Server 3.19.0.85, the video management and NVR server software from NUUO Inc |
From the original article
Posted by disclosure via Fulldisclosure on Oct 28 0day Rubbish Research Team is publicly disclosing a vulnerability in NUUO Crystal Server 3. 19. 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.