CVE-2020-7351

Related Files

TrixBox CE 2.8.0.4 Command Execution

Posted May 5, 2020

Authored by Anastasios Stasinopoulos, Obrela Labs Team | Site metasploit.com

This Metasploit module exploits an authenticated OS command injection vulnerability found in Trixbox CE versions 1.2.0 through 2.8.0.4 inclusive in the network POST parameter of the /maint/modules/endpointcfg/endpoint_devicemap.php page. Successful exploitation allows for arbitrary command execution on the underlying operating system as the asterisk user. Users can easily elevate their privileges to the root user however by executing sudo nmap --interactive followed by !sh from within nmap.

tags | exploit, arbitrary, root, php

advisories | CVE-2020-7351

SHA-256 | d8cf1911eb53fa726641699bb7ddfdc44e28e3c1e9e58c93506d65e29eb0dba8

Download | Favorite | View