This vulnerability (with proof of concept (PoC) code) affects DVR/NVR devices built using the HiSilicon hi3520d and similar system on a chip (SoC).
Exploiting the vulnerabilities lead to unauthorized remote code execution (RCE) using only the web interface, causing full takeover of the exploited device
Severity: high
Fingerprint: 321975614123c6c05f83e99b409a1d43f0e5a138f0e5a138f0e5a138f0e5a138
Found HiSiliconDVR firmware: Hardware: General 50H10L Vulnerable to multiple issues : LFI, possibly RCE
MySQL is currently open without authentication.
This results in all the database data made available publicly.
Severity: high
Fingerprint: cf350410ecceb5fddd1bc95766fdd241127460b6a17954363c8615b50056521a
Databases: 85, row count: 278014, size: 15.4 MB Found table employees.departments with 0 records Found table employees.dept_emp with 0 records Found table employees.dept_manager with 0 records Found table employees.employees with 275319 records Found table employees.salaries with 0 records Found table employees.titles with 0 records Found table mysql.columns_priv with 0 records Found table mysql.db with 2 records Found table mysql.event with 0 records Found table mysql.func with 0 records Found table mysql.general_log with 2 records Found table mysql.help_category with 40 records Found table mysql.help_keyword with 611 records Found table mysql.help_relation with 1218 records Found table mysql.help_topic with 583 records Found table mysql.innodb_index_stats with 177 records Found table mysql.innodb_table_stats with 27 records Found table mysql.ndb_binlog_index with 0 records Found table mysql.plugin with 0 records Found table mysql.proc with 0 records Found table mysql.procs_priv with 0 records Found table mysql.proxies_priv with 2 records Found table mysql.servers with 0 records Found table mysql.slave_master_info with 0 records Found table mysql.slave_relay_log_info with 0 records Found table mysql.slave_worker_info with 0 records Found table mysql.slow_log with 2 records Found table mysql.tables_priv with 0 records Found table mysql.time_zone with 0 records Found table mysql.time_zone_leap_second with 0 records Found table mysql.time_zone_name with 0 records Found table mysql.time_zone_transition with 0 records Found table mysql.time_zone_transition_type with 0 records Found table mysql.user with 8 records Found table phpmyadmin.pma__bookmark with 0 records Found table phpmyadmin.pma__central_columns with 0 records Found table phpmyadmin.pma__column_info with 0 records Found table phpmyadmin.pma__designer_settings with 0 records Found table phpmyadmin.pma__export_templates with 0 records Found table phpmyadmin.pma__favorite with 0 records Found table phpmyadmin.pma__history with 0 records Found table phpmyadmin.pma__navigationhiding with 0 records Found table phpmyadmin.pma__pdf_pages with 0 records Found table phpmyadmin.pma__recent with 1 records Found table phpmyadmin.pma__relation with 0 records Found table phpmyadmin.pma__savedsearches with 0 records Found table phpmyadmin.pma__table_coords with 0 records Found table phpmyadmin.pma__table_info with 0 records Found table phpmyadmin.pma__table_uiprefs with 0 records Found table phpmyadmin.pma__tracking with 0 records Found table phpmyadmin.pma__userconfig with 0 records Found table phpmyadmin.pma__usergroups with 0 records Found table phpmyadmin.pma__users with 0 records Found table shopdb.membertbl with 4 records Found table shopdb.producttbl with 3 records Found table test.g5_auth with 0 records Found table test.g5_autosave with 0 records Found table test.g5_board with 0 records Found table test.g5_board_file with 0 records Found table test.g5_board_good with 0 records Found table test.g5_board_new with 0 records Found table test.g5_cert_history with 0 records Found table test.g5_config with 1 records Found table test.g5_content with 3 records Found table test.g5_faq with 0 records Found table test.g5_faq_master with 1 records Found table test.g5_group with 0 records Found table test.g5_group_member with 0 records Found table test.g5_login with 1 records Found table test.g5_mail with 0 records Found table test.g5_member with 2 records Found table test.g5_memo with 0 records Found table test.g5_menu with 0 records Found table test.g5_new_win with 0 records Found table test.g5_point with 2 records Found table test.g5_poll with 0 records Found table test.g5_poll_etc with 0 records Found table test.g5_popular with 0 records Found table test.g5_qa_config with 1 records Found table test.g5_qa_content with 0 records Found table test.g5_scrap with 0 records Found table test.g5_uniqid with 0 records Found table test.g5_visit with 2 records Found table test.g5_visit_sum with 2 records Found table test.testtable with 0 records