CVE-2019-15029
HIGHFusionPBX 4.4.8 - Authenticated Remote Code Execution via service_edit.php Command Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2019-15029. PoCs published by Askar, mhaskar.
AI-analyzed exploit summary This exploit targets FusionPBX v4.4.8 by authenticating with provided credentials, creating a malicious service with a reverse shell payload, and triggering it to execute arbitrary commands. The payload uses a named pipe and netcat to establish a reverse shell.
Description
FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service_edit.php file (which will insert the malicious command into the database). To trigger the command, one needs to call the services.php file via a GET request with the service id followed by the parameter a=start to execute the stored command.
Exploits (2)
This exploit targets FusionPBX v4.4.8 by authenticating with provided credentials, creating a malicious service with a reverse shell payload, and triggering it to execute arbitrary commands. The payload uses a named pipe and netcat to establish a reverse shell.
The repository contains a functional exploit for CVE-2019-15029, demonstrating authenticated remote code execution in FusionPBX v4.4.8 by injecting a malicious command into the service_edit.php file and triggering it via services.php. It includes both a Python script and a Metasploit module.
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H