CVE-2013-6829

This exploit demonstrates a command injection vulnerability in MailSecure's admin interface, allowing unauthenticated RCE via crafted HTTP requests. The PoC includes detailed steps for privilege escalation to root by exploiting weak sudoers configuration.

This Metasploit module exploits a command injection vulnerability in PineApp Mail-SeCure 3.70 via the test_li_connection.php component, which insecurely uses the system() PHP function. It retrieves a session cookie and injects a payload into the iptest parameter to achieve remote command execution.