CVE-2017-12478

This Metasploit module exploits an authentication bypass and command injection vulnerability in Unitrends Backup (UEB) versions before 10.0.0 and UEB < 10.1.0. It leverages SQL injection for authentication bypass and command injection via unvalidated input parameters in the API endpoints.

This Metasploit module exploits an authentication bypass and command injection vulnerability in Unitrends Backup (UB) before 10.0.0 via the api/storage endpoint. It uses a SQLi-based session token to bypass authentication and injects arbitrary commands through the hostname parameter.

This exploit leverages a SQL injection vulnerability for authentication bypass and command injection to achieve unauthenticated root remote code execution on Unitrends UEB 9.1. It sends a crafted payload to execute a reverse shell or a custom command.

This Metasploit module exploits an authentication bypass and command injection vulnerability in Unitrends Backup (UEB) versions before 10.0.0. It leverages SQL injection for authentication bypass and command injection via unvalidated input parameters in the API endpoints.