Oiwtech OIW-2431APGN-HP Command Injection Vulnerability in Personal Script Submenu

A critical command injection vulnerability has been identified in Oiwtech OIW-2431APGN-HP version 2.5.3-B20131128. The issue arises in the Personal Script Submenu, specifically within the file '/boafrm/formScript'. This vulnerability allows remote attackers to execute operating system commands by injecting malicious input that is not properly sanitized before being processed.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the underlying operating system.

Reproduction

To reproduce this vulnerability, authenticate on the web management interface of the affected Oiwtech device. Navigate to the 'Management' menu and select the 'Personal Script' submenu. Once there, use the script input to inject a command that initiates a reverse shell, directing the output to an external server. This command will be executed by the system, effectively compromising the device.