CVE-2020-24032 – tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=s

tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24032

Reference (s):

• https://pastebin.com/G8981Fj8
• https://pastebin.com/dHhawgx8
• https://www.stor2rrd.com/download.php