what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 3 of 3

Files from Dustin Cobb

FusionPBX Operator Panel exec.php Command Execution

Posted Nov 14, 2019

Authored by Brendan Coles, Dustin Cobb | Site metasploit.com

This Metasploit module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior. The exec.php file within the Operator Panel permits users with operator_panel_view permissions, or administrator permissions, to execute arbitrary commands as the web server user by sending a system command to the FreeSWITCH event socket interface. This module has been tested successfully on FusionPBX version 4.4.1 on Ubuntu 19.04 (x64).

tags | exploit, web, arbitrary, php

systems | linux, ubuntu

advisories | CVE-2019-11409

SHA-256 | 38468e6614fd2cb8667101b151bf487ee43e93ccd419b6ad4216f21cee042b1e

Download | Favorite | View

FusionPBX 4.4.3 Remote Command Execution

Posted Jun 12, 2019

Authored by Dustin Cobb

FusionPBX versions 4.4.3 and below suffer from a remote code execution vulnerability via cross site scripting.

tags | exploit, remote, code execution, xss

advisories | CVE-2019-11408, CVE-2019-11409

SHA-256 | 2116c72ea7f7eb6337234a9d1cddbfc94c56900a0a24c8146f1617c1a0139fca

Download | Favorite | View

BlogEngine.NET 3.3.6 Directory Traversal / Remote Code Execution

Posted Feb 12, 2019

Authored by Dustin Cobb

BlogEngine.NET version 3.3.6 suffers from code execution and directory traversal vulnerabilities.

tags | exploit, vulnerability, code execution, file inclusion

advisories | CVE-2019-6714

SHA-256 | e49280b62c0fab022834f64d848d66c34f0be69807c773aa5c6000bf8eead37e

Download | Favorite | View