FusionPBX Command exec.php Command Execution
Posted by deepcore on November 15, 2019 – 2:30 pm
This Metasploit module uses administrative functionality available in FusionPBX to gain a shell. The Command section of the application permits users with exec_view permissions, or superadmin permissions, to execute arbitrary system commands, or arbitrary PHP code, as the web server user. This module has been tested successfully on FusionPBX version 4.4.1 on Ubuntu 19.04 (x64).
Post a reply
You must be logged in to post a comment.