Exploitation Summary
EIP tracks 3 public exploits for CVE-2012-10028.
PoCs published by Metasploit, Spencer McIntyre, Spencer McIntyre, sinn3r, including Metasploit module exploits/multi/http/netwin_surgeftp_exec.
AI-analyzed exploit summary This Metasploit module exploits a remote command execution vulnerability in Netwin SurgeFTP by authenticating to the web-based administrative console and sending a crafted POST request to execute arbitrary commands via the 'authent_process' parameter.
Description
Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to `surgeftpmgr.cgi`. This can lead to full remote code execution on the underlying system.
Exploits (3)
This Metasploit module exploits a remote command execution vulnerability in Netwin SurgeFTP by authenticating to the web-based administrative console and sending a crafted POST request to execute arbitrary commands via the 'authent_process' parameter.
This Metasploit module exploits a command injection vulnerability in SurgeFTP's web-based administrative console by sending a crafted POST request to the `/cgi/surgeftpmgr.cgi` endpoint with an arbitrary command embedded in the `authent_process` parameter.
This Metasploit module exploits a vulnerability in Netwin SurgeFTP (version 23c8 or prior) to achieve remote command execution. It leverages authenticated access to the web-based administrative console to execute arbitrary commands via the `surgeftpmgr.cgi` endpoint.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N