CVE-2022-39986

Related Files

RaspAP 2.8.7 Unauthenticated Command Injection

Posted Aug 15, 2023

Authored by Ege Balci, Ismael0x00 | Site metasploit.com

RaspAP is feature-rich wireless router software that just works on many popular Debian-based devices, including the Raspberry Pi. A Command Injection vulnerability in RaspAP versions 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands in the context of the user running RaspAP via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php. Successfully tested against RaspAP 2.8.0 and 2.8.7.

tags | exploit, arbitrary, php

systems | linux, debian

advisories | CVE-2022-39986

SHA-256 | abc5a8577c76d38277377259204d36eaaa8e98293d1ed4d1030fb74de2c622f0

Download | Favorite | View