CVE-2014-8687

This Metasploit module exploits an unauthenticated remote command execution vulnerability in Seagate Business NAS devices via a local file inclusion vulnerability in the CodeIgniter session cookie. It manipulates the session cookie to gain admin privileges and then injects a PHP payload to achieve remote code execution.

This exploit targets a pre-authentication remote code execution vulnerability in Seagate Business NAS devices. It leverages a session manipulation flaw to execute arbitrary commands as root, either by installing a webshell or generating an admin session cookie.

This Metasploit module exploits an unauthenticated remote command execution vulnerability in Seagate Business NAS devices via a local file inclusion flaw in the CodeIgniter session cookie's language parameter. It decrypts the session cookie, modifies it to gain admin privileges, and injects a PHP payload to achieve RCE.