CVE-2018-6328

This Metasploit module exploits an authentication bypass and command injection vulnerability in Unitrends Backup (UEB) versions before 10.0.0 and UEB < 10.1.0. It leverages SQL injection for authentication bypass and command injection via unvalidated input parameters in the API endpoints.

This exploit leverages an unauthenticated SQL injection (CVE-2018-6328) to achieve remote command execution as a low-privileged user, followed by a local privilege escalation (CVE-2018-6329) to execute arbitrary commands as root. It establishes a reverse shell via a bindshell and uploads a Python-based privilege escalation script.

This Metasploit module exploits an authentication bypass and command injection vulnerability in Unitrends Backup (UEB) before 10.0.0. It uses SQL injection to bypass authentication and injects arbitrary commands via the 'hostname' or 'ip' parameters in the API endpoints '/api/storage' (UEB 9) or '/api/hosts' (UEB < 10.1.0).