Full title: Seagate Business NAS <= 2014.00319 - Pre-Authentication Remote Code Execution (0day) 
Category: web applications
Platform: hardware
Some Seagate Business NAS devices are vulnerable to command execution via a local file include vulnerability hidden in the language parameter of the CodeIgniter session cookie. The vulnerability manifests in the way the language files are included in the code on the login page, and hence is open to attack from users without the need for authentication. The cookie can be easily decrypted using a known static encryption key and re-encrypted once the PHP object string has been modified. This module has been tested on the STBN300 device.

# 0day.today @ http://0day.today/