what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files

OpenMediaVault Cron Remote Command Execution

Posted Oct 30, 2013

Authored by Brandon Perry | Site metasploit.com

OpenMediaVault allows an authenticated user to create cron jobs as arbitrary users on the system. An attacker can abuse this to run arbitrary commands as any user available on the system (including root).

tags | exploit, arbitrary, root

advisories | CVE-2013-3632

SHA-256 | 94cc0202bafd6d8e09dab8de5983f2f26db28f5d5e4ab61e3830ec9bd40f3b41

Download | Favorite | View

Related Files

OpenMediaVault rpc.php Authenticated PHP Code Injection

Posted Nov 25, 2020

Authored by Anastasios Stasinopoulos | Site metasploit.com

This Metasploit module exploits an authenticated PHP code injection vulnerability found in openmediavault versions before 4.1.36 and 5.x versions before 5.5.12 inclusive in the "sortfield" POST parameter of the rpc.php page, because "json_encode_safe()" is not used in config/databasebackend.inc. Successful exploitation grants attackers the ability to execute arbitrary commands on the underlying operating system as root.

tags | exploit, arbitrary, root, php

advisories | CVE-2020-26124

SHA-256 | e0e5ffa0c0727fd8caae8d1a6288e302aebc6906241ff1131429f2abbcdbe8a1

Download | Favorite | View