CVE-2018-6329
CRITICALUnitrends Backup < 10.1.10 - SQL Injection and Remote Code Execution via Authentication Bypass
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2018-6329.
PoCs published by Metasploit, Jared Arave, Cale Smith, Benny Husted, Jared Arave, h00die, including Metasploit module exploits/linux/local/ueb_bpserverd_privesc.
AI-analyzed exploit summary This Metasploit module exploits an authentication bypass in Unitrends Enterprise Backup's bpserverd service (CVE-2018-6329) to achieve local privilege escalation by dropping and executing a payload via a Python script.
Description
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands.
Exploits (3)
This Metasploit module exploits an authentication bypass in Unitrends Enterprise Backup's bpserverd service (CVE-2018-6329) to achieve local privilege escalation by dropping and executing a payload via a Python script.
This exploit leverages an unauthenticated SQL injection (CVE-2018-6328) to achieve remote command execution as a low-privileged user, followed by a local privilege escalation (CVE-2018-6329) to execute arbitrary commands as root. It establishes a reverse shell via a bindshell and uploads a Python-based privilege escalation script.
This Metasploit module exploits an authentication bypass in Unitrends Enterprise Backup's bpserverd service to achieve local privilege escalation by executing arbitrary commands as root via a proprietary protocol exposed through xinetd.
References (4)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H