CVE-2016-15048
📋 TL;DR
This is an unauthenticated remote command injection vulnerability in AMTT Hotel Broadband Operation System (HiBOS). Attackers can execute arbitrary system commands as the web server user by sending specially crafted requests to the /manager/radius/server_ping.php endpoint. Any system running vulnerable HiBOS software is affected, and exploitation has been observed in the wild.
💻 Affected Systems
- AMTT Hotel Broadband Operation System (HiBOS)
- Potentially rebranded versions under different names
📦 What is this software?
Hibos by Amttgroup
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to install malware, pivot to other systems, steal sensitive data, or disrupt hotel operations.
Likely Case
Installation of cryptocurrency miners, backdoors, or ransomware leading to system downtime and data theft.
If Mitigated
Limited impact if network segmentation prevents lateral movement and command execution is restricted via security controls.
🎯 Exploit Status
VulnCheck confirmed exploitation in the wild as of October 2025. Public proof-of-concept code exists in Nuclei templates and third-party disclosures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.amttgroup.com/
Restart Required: No
Instructions:
Contact AMTT Group for remediation guidance as recommended in the original disclosure. No official patch information is publicly available.
🔧 Temporary Workarounds
Block Access to Vulnerable Endpoint
allUse web application firewall or reverse proxy to block all access to /manager/radius/server_ping.php
# Apache: RewriteRule ^/manager/radius/server_ping\.php$ - [F]
# Nginx: location ~ ^/manager/radius/server_ping\.php$ { deny all; }
Input Validation via Web Server
linuxImplement input validation at the web server level to reject requests containing shell metacharacters in the ip parameter
# ModSecurity rule: SecRule ARGS:ip "[;|&`$()]" "deny,status:403,id:1001"
🧯 If You Can't Patch
- Isolate the HiBOS system in a dedicated network segment with strict firewall rules limiting inbound/outbound connections
- Implement network-based intrusion detection to monitor for exploitation attempts and command execution patterns
🔍 How to Verify
Check if Vulnerable:
Test if the endpoint /manager/radius/server_ping.php exists and accepts the ip parameter. Attempt to inject a harmless command like 'ip=127.0.0.1;echo+test' and check for command execution.Check Version:
Check HiBOS version through admin interface or contact vendor. No standard command available.Verify Fix Applied:
Verify that requests to /manager/radius/server_ping.php are blocked or properly sanitize input containing shell metacharacters.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /manager/radius/server_ping.php with shell metacharacters in parameters
- Web server logs showing command execution patterns in URL parameters
- Unusual process execution from web server user account
Network Indicators:
- HTTP POST/GET requests containing shell metacharacters (;, |, &, `, $, (, )) in the ip parameter
- Outbound connections from HiBOS server to suspicious IPs following exploitation
SIEM Query:
web.url:*server_ping.php AND (web.param.ip:*;* OR web.param.ip:*|* OR web.param.ip:*&* OR web.param.ip:*`* OR web.param.ip:*$* OR web.param.ip:*(* OR web.param.ip:*)*)🔗 References
- https://github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/remote_code_execution/hiboss-rce_2.yaml#L21
- https://wooyun.laolisafe.com/bug_detail.php?wybug_id=wooyun-2016-0181444
- https://www.amttgroup.com/
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-37784
- https://www.vulncheck.com/advisories/amtt-hibos-command-injection-rce-via-server-ping-php
