what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News Services About Contact Add New

Showing 1 - 3 of 3

Files from Dustin Cobb

FusionPBX Operator Panel exec.php Command Execution

Posted Nov 14, 2019

Authored by Brendan Coles, Dustin Cobb | Site metasploit.com

This Metasploit module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior. The exec.php file within the Operator Panel permits users with operator_panel_view permissions, or administrator permissions, to execute arbitrary commands as the web server user by sending a system command to the FreeSWITCH event socket interface. This module has been tested successfully on FusionPBX version 4.4.1 on Ubuntu 19.04 (x64).

tags | exploit, web, arbitrary, php

systems | linux, ubuntu

advisories | CVE-2019-11409

MD5 | 8371c066836fe4c5336f32a7b5aa18d5

Download | Favorite | Comments (1)

FusionPBX 4.4.3 Remote Command Execution

Posted Jun 12, 2019

Authored by Dustin Cobb

FusionPBX versions 4.4.3 and below suffer from a remote code execution vulnerability via cross site scripting.

tags | exploit, remote, code execution, xss

advisories | CVE-2019-11408, CVE-2019-11409

MD5 | fceaec3a265cd08a10da41887c689047

Download | Favorite | Comments (0)

BlogEngine.NET 3.3.6 Directory Traversal / Remote Code Execution

Posted Feb 12, 2019

Authored by Dustin Cobb

BlogEngine.NET version 3.3.6 suffers from code execution and directory traversal vulnerabilities.

tags | exploit, vulnerability, code execution, file inclusion

advisories | CVE-2019-6714

MD5 | 5d60a05646610a370fa6e7cddfe9d0f6

Download | Favorite | Comments (0)