[0day-rubbish] RCDevs WebADM 2.4.14 authenticated log viewer sid command injection to webadm uid 999 code execution (7.2)
Disclosure: RCDevs WebADM 2.4.14 log viewer command injection yields code execution as uid 999.
The 0day Rubbish Research Team disclosed an authenticated OS command injection in RCDevs WebADM 2.4.14 Freeware Edition. WebADM is the closed-source IAM and MFA console from RCDevs Security SA in Luxembourg and fronts OpenOTP, SpanKey, and TiQR. The administrator log viewer's sid command can be injected to execute code as webadm uid 999. The issue is scored 7.2, with related input-handling and permission weaknesses noted, and exploitation in the wild is not described.
- Authenticated command injection in the WebADM 2.4.14 log viewer.
- Successful injection runs code as webadm uid 999.
- WebADM fronts OpenOTP, SpanKey, and TiQR authentication products.
- Reported score is 7.2; in-the-wild use is not stated.
- Vendors
- RCDevs
- Organizations
- 0day Rubbish Research TeamRCDevs Security SA
- Countries
- Luxembourg
From the original article
Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in RCDevs WebADM 2. 4. 14, Freeware Edition, the closed-source IAM/MFA management platform from RCDevs Security SA (Luxembourg) that fronts the vendor's OpenOTP, SpanKey and TiQR authentication products.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.