WIFISKY 7-Layer Flow Control Router Remote Command Injection Vulnerability

A remote command injection vulnerability has been identified in the WIFISKY 7-layer Flow Control Router. This vulnerability exists in the confirm.php interface, where insufficient input validation allows unauthenticated attackers to execute arbitrary operating system commands. The issue can be exploited by sending a specially crafted HTTP GET request that targets the 't' parameter.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected router, giving an attacker control over the device. This could lead to further attacks on other systems within the network, data breaches, service disruptions, and potential installation of backdoors for future access.

Reproduction

To reproduce this vulnerability, send an HTTP GET request to the confirm.php interface of the WIFISKY 7-layer Flow Control Router. Include a payload in the 't' parameter that takes advantage of the insufficient input validation to inject and execute arbitrary OS commands. Once the command is executed, it may be possible to interact with external endpoints by specifying them in the payload.