what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Ismael0x00

RaspAP 2.8.7 Unauthenticated Command Injection

Posted Aug 15, 2023

Authored by Ege Balci, Ismael0x00 | Site metasploit.com

RaspAP is feature-rich wireless router software that just works on many popular Debian-based devices, including the Raspberry Pi. A Command Injection vulnerability in RaspAP versions 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands in the context of the user running RaspAP via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php. Successfully tested against RaspAP 2.8.0 and 2.8.7.

tags | exploit, arbitrary, php

systems | linux, debian

advisories | CVE-2022-39986

SHA-256 | abc5a8577c76d38277377259204d36eaaa8e98293d1ed4d1030fb74de2c622f0

Download | Favorite | View