CVE-2019-11409

Related Files

FusionPBX Operator Panel exec.php Command Execution

Posted Nov 14, 2019

Authored by Brendan Coles, Dustin Cobb | Site metasploit.com

This Metasploit module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior. The exec.php file within the Operator Panel permits users with operator_panel_view permissions, or administrator permissions, to execute arbitrary commands as the web server user by sending a system command to the FreeSWITCH event socket interface. This module has been tested successfully on FusionPBX version 4.4.1 on Ubuntu 19.04 (x64).

tags | exploit, web, arbitrary, php

systems | linux, ubuntu

advisories | CVE-2019-11409

SHA-256 | 38468e6614fd2cb8667101b151bf487ee43e93ccd419b6ad4216f21cee042b1e

Download | Favorite | View

FusionPBX 4.4.3 Remote Command Execution

Posted Jun 12, 2019

Authored by Dustin Cobb

FusionPBX versions 4.4.3 and below suffer from a remote code execution vulnerability via cross site scripting.

tags | exploit, remote, code execution, xss

advisories | CVE-2019-11408, CVE-2019-11409

SHA-256 | 2116c72ea7f7eb6337234a9d1cddbfc94c56900a0a24c8146f1617c1a0139fca

Download | Favorite | View