TOTOLINK A6000R Command Injection Vulnerability in WSH Enable Function

A command injection vulnerability has been identified in the TOTOLINK A6000R router, specifically in firmware version V1.0.1-B20201211.2000. The vulnerability arises in the 'enable_wsh' function within the 'system.lua' file, where the 'modifyOne' parameter can be exploited to inject arbitrary commands.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the device.

Reproduction

To reproduce this vulnerability, send a GET request to the '/cgi-bin/luci/admin/mtk/wsh_enable_submit' endpoint. Include the 'modifyOne' parameter with a payload that injects a command, such as listing directory contents and redirecting the output to a file. The injection can be verified by checking for the presence of the output file.