TrixBox CE 2.8.0.4 Command Execution
Posted by deepcore on May 6, 2020 – 7:43 pm
This Metasploit module exploits an authenticated OS command injection vulnerability found in Trixbox CE versions 1.2.0 through 2.8.0.4 inclusive in the network POST parameter of the /maint/modules/endpointcfg/endpoint_devicemap.php page. Successful exploitation allows for arbitrary command execution on the underlying operating system as the asterisk user. Users can easily elevate their privileges to the root user however by executing sudo nmap –interactive followed by !sh from within nmap.
Post a reply
You must be logged in to post a comment.