selea_network_camera 漏洞

高危2023/10/20

Selea Targa IP OCR-ANPR Camera - Unauthenticated SSRF

Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the Selea ANPR camera within several functionalities. The application parses user supplied data in the POST JSON parameters 'ipnotify_address' and 'url' to construct an image request or check DNS for IP notification. Since no validation is carried out on the parameters, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host. This can be used by an external attacker for example to bypass firewalls and initiate a service and network enumeration on the internal network through the affected application.

selea_network_cameraPoC 已收录

CVSS—

高危2023/10/20

Selea Targa IP OCR-ANPR Camera - Local File Inclusion

Selea Targa IP OCR-ANPR camera suffers from an unauthenticated local file inclusion vulnerability because input passed through the Download Archive in Storage page using get_file.php script is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks and aid the attacker in disclosing clear-text credentials.

selea_network_cameraPoC 已收录

CVSS8.6

selea_network_camera

关联漏洞

Selea Targa IP OCR-ANPR Camera - Unauthenticated SSRF

Selea Targa IP OCR-ANPR Camera - Local File Inclusion