CVE-2008-6825
trixbox < 2.6.1 - Remote File Inclusion via langChoice Parameter
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2008-6825.
PoCs published by Metasploit, muts, Jean-Michel BESNARD, including Metasploit module exploits/unix/webapp/trixbox_langchoice.
AI-analyzed exploit summary This Metasploit module exploits a PHP Local File Inclusion vulnerability in Trixbox CE 2.6.1 by injecting malicious PHP code into the session file and then executing it via the langChoice parameter.
Description
Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the langChoice parameter.
Exploits (4)
This Metasploit module exploits a PHP Local File Inclusion vulnerability in Trixbox CE 2.6.1 by injecting malicious PHP code into the session file and then executing it via the langChoice parameter.
This exploit targets a PHP session file inclusion vulnerability in TrixBox 2.6.1 to inject a reverse shell payload via the 'langChoice' parameter. It extracts the session ID, triggers the payload, and establishes a root shell.
This exploit targets a directory traversal vulnerability in Trixbox's PHP session handling to achieve remote code execution. It leverages a reverse shell payload via Perl's Socket module, with options for root or asterisk user privileges via sudo.
This Metasploit module exploits a PHP Local File Inclusion vulnerability in Trixbox by injecting malicious PHP code into the session file and then triggering its execution via the langChoice parameter.