CVE-2014-4688

pfSense < 2.1.4 - 'status_rrd_graph_img.php' Command Injection

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2014-4688 has a selected CVSS score of 6.5; EIP currently links 1 catalogued exploit and 3 repository PoCs.

Description

pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_dns.php in a Create Alias action, (2) the smartmonemail value to diag_smart.php, or (3) the database value to status_rrd_graph_img.php.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
3

Proofs of concept

4

Catalogued exploits

ExploitDBpfSense < 2.1.4 - 'status_rrd_graph_img.php' Command InjectionExploitDB exploitby absolombNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubjaydenblair/CVE-2014-4688-pfsenseRepository PoCby jaydenblair0Exploit2 files

5.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to pfSense, injects a command via the database parameter in status_rrd_graph_img.php, and delivers a reverse shell.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python 3 PoC exploit for CVE-2014-4688 and a README. The exploit authenticates to a pfSense target, injects a reverse shell command via the database parameter, and waits for a connection. No concealed backdoor, unrelated payload, or operator-directed harm is present. The code performs only the advertised exploit behavior.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwarepfSense
Attack typescommand injectionreverse shell
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits CVE-2014-4688 by authenticating to the target, injecting a command, and establishing a reverse shell. It is not a scanner or writeup; it is functional exploit code.

cve-2014-4688.py:1-115README.md:1-46

Requirements

  • Valid pfSense credentials (username and password)cve-2014-4688.py:31-32
  • Network listener to receive reverse shellcve-2014-4688.py:23-24

Observed behavior

  • Authenticates to pfSense web interface using provided credentials and CSRF tokencve-2014-4688.py:84-102
  • Constructs a reverse shell payload and encodes it in octalcve-2014-4688.py:43-58
  • Sends a GET request to status_rrd_graph_img.php with the database parameter containing the injected commandcve-2014-4688.py:61cve-2014-4688.py:111
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell Payload
Payload withheldThe payload connects back to the attacker-supplied lhost:lport and spawns an interactive shell. This is the expected behavior for a command injection PoC targeting the stated CVE.cve-2014-4688.py:43-51
Command Injection Vector
Payload withheldThe exploit constructs a URL that injects a shell command through the database parameter, consistent with the CVE description.cve-2014-4688.py:61
Authentication Mechanism
Payload withheldThe script authenticates using supplied credentials and a CSRF token, which is required for the authenticated command injection described in CVE-2014-4688.cve-2014-4688.py:84-102
Review boundaries

What the analysis did not establish

  • Only the two text files (README.md and cve-2014-4688.py) were reviewed; no other files exist in the repository snapshot.
  • The review does not execute the code and cannot verify runtime behavior or hidden dependencies.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubandyfeili/CVE-2014-4688Repository PoCby andyfeili1Not analyzed2 files

3.5 KiB

GitHub
PoC details
GitHubnote0577/CVE-2014-4688-NodeJs-ExploitRepository PoCby fenix04990Not analyzed2 files

4.8 KiB

GitHub
PoC details

References

3