CVE-2014-5073

VMTurbo Operations Manager <4.6 - Command Injection

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2014-5073. PoCs published by Metasploit, including Metasploit module exploits/unix/http/vmturbo_vmtadmin_exec_noauth.

AI-analyzed exploit summary This Metasploit module exploits a blind OS command injection vulnerability in VMTurbo Operations Manager 4.6 and prior via the vmtadmin.cgi endpoint. It supports both direct command execution and staged payload delivery for Linux targets.

Description

vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call.

Exploits (2)

exploitdb WORKING POC

by Metasploit · rubyremotelinux

https://www.exploit-db.com/exploits/34335

View Code ZIP pw:eip

This Metasploit module exploits a blind OS command injection vulnerability in VMTurbo Operations Manager 4.6 and prior via the vmtadmin.cgi endpoint. It supports both direct command execution and staged payload delivery for Linux targets.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: VMTurbo Operations Manager <= 4.6

No auth needed

Prerequisites: Network access to the target's web interface · VMTurbo Operations Manager version <= 4.6 with build < 28657

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC EXCELLENT

rubypocunix

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/vmturbo_vmtadmin_exec_noauth.rb

View Code ZIP pw:eip

This Metasploit module exploits an unauthenticated OS command injection vulnerability in VMTurbo Operations Manager's web interface via the vmtadmin.cgi endpoint. It supports both direct command execution and staged payload delivery for Linux targets.