Selea CarPlateServer Remote Program Execution Vulnerability

A remote program execution vulnerability has been identified in Selea CarPlateServer version 4.0.1.6. This vulnerability allows attackers to execute arbitrary Windows binaries by manipulating the NO_LIST_EXE_PATH configuration parameter. Exploitation can be achieved by bypassing authentication through the /cps/ endpoint, enabling attackers to modify server configurations, including admin passwords and the execution of system commands.

Impact

Exploitation of this vulnerability allows for arbitrary execution of Windows binaries, potentially leading to unauthorized access or actions on the server.

Reproduction

To reproduce this vulnerability, authenticate to the Selea CarPlateServer application and navigate to the /cps/ endpoint. Once authenticated, the NO_LIST_EXE_PATH variable can be set to a desired executable. If the configuration is accepted, the specified program will be executed on the server.