CVEs-PoC/2018/CVE-2018-5757.md

### [CVE-2018-5757](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5757)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to Remote Code Execution via shell metacharacters in the query string.

### POC

#### Reference
- https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2018-5757

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/H4cksploit/CVEs-master
- https://github.com/RhinoSecurityLabs/CVEs
- https://github.com/likescam/CVEs_new_by_Rhino-Security-Labs-
- https://github.com/merlinepedra/RHINOECURITY-CVEs
- https://github.com/merlinepedra25/RHINOSECURITY-CVEs
- https://github.com/nattimmis/CVE-Collection
- https://github.com/sunzu94/AWS-CVEs