{"uuid": "8296f6c2-baf0-454a-aa76-4681789696b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35665", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd, x64, x86, aarch64\", \"author\": [\"h00die-gr3y \", \"IHTeam\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated remote code-execution vulnerability in TerraMaster TOS 4.2.06\\n          and lower via shell metacharacters in the Event parameter at vulnerable endpoint `include/makecvs.php`\\n          during CSV creation.\\n          Any unauthenticated user can therefore execute commands on the system under the same privileges as the\\n          web application, which typically runs under root at the TerraMaster Operating System.\", \"disclosure_date\": \"2020-12-12\", \"fullname\": \"exploit/linux/http/terramaster_unauth_rce_cve_2020_35665\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:55:15 +0000\", \"name\": \"TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb\", \"platform\": \"Linux,PHP,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/terramaster_unauth_rce_cve_2020_35665\", \"references\": [\"CVE-2020-35665\", \"CVE-2020-28188\", \"PACKETSTORM-160685\", \"PACKETSTORM-160687\", \"URL-https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/\", \"URL-https://attackerkb.com/topics/lXY4yjOvwx/cve-2020-35665\"], \"rport\": 8181, \"session_types\": false, \"targets\": [\"PHP\", \"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:58.084627Z"}