CVE-2011-4542
Hastymail2 2.1.1 - Remote Code Execution via rs or rsargs[] Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-4542.
PoCs published by Metasploit, Bruno Teixeira, juan vazquez, including Metasploit module exploits/unix/webapp/hastymail_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Hastymail 2.1.1 RC1 via insecure usage of `call_user_func_array()` in `lib/ajax_functions.php`. It authenticates, then injects a payload through the `passthru` function.
Description
Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action to the default URI.
Exploits (2)
This Metasploit module exploits a command injection vulnerability in Hastymail 2.1.1 RC1 via insecure usage of `call_user_func_array()` in `lib/ajax_functions.php`. It authenticates, then injects a payload through the `passthru` function.
This Metasploit module exploits a command injection vulnerability in Hastymail 2.1.1 RC1 via insecure usage of `call_user_func_array()` in `lib/ajax_functions.php`. It authenticates with provided credentials and injects a payload through the `passthru` function.