CVE-2011-10013

This Metasploit module exploits an authentication bypass and remote code execution vulnerability in Traq <= 2.3 by leveraging a broken authorization schema in admincp/common.php, allowing arbitrary PHP code execution via the plugins.php functionality.

This exploit leverages an authentication bypass in Traq <= 2.3 due to improper header() usage, allowing unauthenticated RCE via plugin creation. It sends a crafted POST request to create a malicious plugin and then executes commands via HTTP headers.

This Metasploit module exploits a broken authorization schema in Traq 2.0 to 2.3, allowing arbitrary PHP code execution via the admincp/plugins.php script. It leverages a base64-encoded payload delivered through the CMD header to achieve remote code execution.