CVE-2018-18982

Related Files

Nuuo Central Management SQL Injection

Posted Feb 21, 2019

Authored by Pedro Ribeiro | Site metasploit.com

The Nuuo Central Management Server allows an authenticated user to query the state of the alarms. This functionality can be abused to inject SQL into the query. As SQL Server 2005 Express is installed by default, xp_cmdshell can be enabled and abused to achieve code execution. This module will either use a provided session number (which can be guessed with an auxiliary module) or attempt to login using a provided username and password - it will also try the default credentials if nothing is provided.

tags | exploit, code execution

advisories | CVE-2018-18982

SHA-256 | 37ab5bd3eec6195dfddf3099592e9cd3aad7e37d04562dd4ebba3cbc36289fe3

Download | Favorite | View

NUUO CMS Session Tokens / Traversal / SQL Injection

Posted Jan 21, 2019

Authored by Pedro Ribeiro

NUUO CMS suffers from directory traversal, predictable session token, unauthenticated remote code execution, and various other vulnerabilities. Multiple metasploit modules included and various versions are affected by the various vulnerabilities.

tags | exploit, remote, vulnerability, code execution

advisories | CVE-2018-17888, CVE-2018-17890, CVE-2018-17892, CVE-2018-17894, CVE-2018-17934, CVE-2018-17936, CVE-2018-18982

SHA-256 | 273126839ae6bdeeeeb0b494ac7067a5ea7b4bb5683ea0378c2a64b28c581aee

Download | Favorite | View