CVE-2013-3631
NAS4Free <= 9.1.0.1.804 - Authenticated Remote Code Execution via Advanced Execute Command Feature
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-3631.
PoCs published by Metasploit, including Metasploit module exploits/multi/http/nas4free_php_exec.
AI-analyzed exploit summary This Metasploit module exploits an authenticated remote code execution vulnerability in NAS4Free by posting PHP code to a special HTTP script. It authenticates, retrieves an auth token, and sends a multipart form with the payload to execute arbitrary PHP code.
Description
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.
Exploits (2)
This Metasploit module exploits an authenticated remote code execution vulnerability in NAS4Free by posting PHP code to a special HTTP script. It authenticates, retrieves an auth token, and sends a multipart form with the payload to execute arbitrary PHP code.
This Metasploit module exploits an authenticated remote code execution vulnerability in NAS4Free by posting PHP code to a special HTTP script. It authenticates, retrieves an auth token, and sends a multipart form with the payload to execute arbitrary PHP code.