CVE-2013-6829
PineApp Mail-SeCure - Remote Code Execution via Ping Host Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-6829.
PoCs published by Dave Weinstein, juan vazquez, including Metasploit module exploits/linux/http/pineapp_test_li_conn_exec.
AI-analyzed exploit summary This exploit demonstrates a command injection vulnerability in MailSecure's admin interface, allowing unauthenticated RCE via crafted HTTP requests. The PoC includes detailed steps for privilege escalation to root by exploiting weak sudoers configuration.
Description
admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation.
Exploits (2)
This exploit demonstrates a command injection vulnerability in MailSecure's admin interface, allowing unauthenticated RCE via crafted HTTP requests. The PoC includes detailed steps for privilege escalation to root by exploiting weak sudoers configuration.
This Metasploit module exploits a command injection vulnerability in PineApp Mail-SeCure 3.70 via the test_li_connection.php component, which insecurely uses the system() PHP function. It retrieves a session cookie and injects a payload into the iptest parameter to achieve remote command execution.