Logsign Remote Command Injection
Posted by deepcore on March 25, 2017 – 2:03 am
This Metasploit module exploits an command injection vulnerability in Logsign. By exploiting this vulnerability, unauthenticated users can execute arbitrary code under the root user. Logsign has a publicly accessible endpoint. That endpoint takes a user input and then use it during operating system command execution without proper validation. This Metasploit module was tested against 4.4.2 and 4.4.137 versions.
Post a reply
You must be logged in to post a comment.