CVE Feed

    Dashboard / CVE / CVE-2017-9328

    CVE-2017-9328

    Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root.

    Published:Sep 15, 2017
    Last Modified:Apr 20, 2025
    EPS:Sep 15, 2017
    EPSS Score:0.06214
    CVSS Score:9.8

    Affected Products

    Vendor
    Terra-master
    Product
    Terramaster Operating System

    Exploits

    https://gist.github.com/hybriz/63bbe2d963e531357aca353c74dd1ad5https://gist.github.com/hybriz/63bbe2d963e531357aca353c74dd1ad5

    Related CVEs

    CVE-2022-24989 (CVSS 9.8) — TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype …
    CVE-2022-24990 (CVSS 7.5) — TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending …
    CVE-2020-35665 (CVSS 9.8) — An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metachar…
    CVE-2018-13357 (CVSS 5.4) — Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript…
    CVE-2018-13356 (CVSS 8.8) — Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user pe…
    CVE-2018-13338 (CVSS 9.8) — System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system …
    CVE-2018-13336 (CVSS 9.8) — System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system …
    CVE-2018-13351 (CVSS 4.8) — Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript…
    CVE-2018-13353 (CVSS 8.8) — System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute command…
    CVE-2018-13354 (CVSS 9.8) — System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High