0day.today
https://0day.today/exploit/33544 CVE-2019-25065
MEDIUM
OpenNetAdmin os command injection
Record summary
CVE-2019-25065 has a selected CVSS score of 6.3 (medium); EIP currently links 1 catalogued exploit and 2 repository PoCs.
Description
A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Jan 13, 2024 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 14, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
opennetadminBrowse opennetadmin / opennetadmin | VulnCheck | Version data not supplied | |
OpenNetAdmin | CVE List | 18.1.1 | affected |
Proofs of concept
3Catalogued exploits
MetasploitOpenNetAdmin Ping Command InjectionMetasploit exploitby Onur ER <onur@onurer.net> +1 moreNot analyzed1 file
Repository PoCs
GitHubtr3m0x/CVE-2019-25065-pocRepository PoCby tr3m0xStars: 0Exploit2 files
Analysis
Technical assessment
A Python script that exploits CVE-2019-25065, an OS command injection vulnerability in OpenNetAdmin <=18.1.1, by sending a crafted POST request to execute arbitrary commands on the target.
Backdoor review
No backdoor observed in reviewed code
The PoC consists of a Python script that exploits CVE-2019-25065 (OS command injection in OpenNetAdmin) and a short README. The script sends crafted POST requests to a user-supplied URL to execute an arbitrary command provided by the user. All behavior is consistent with a standard public exploit: it accepts a target URL and command, sends the injection payload, and prints the output. No concealed executable behavior, persistence, credential theft, unrelated remote access, or deceptive payloads were observed.
ClassificationExploit
Model confidence100%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The script constructs and sends a malicious HTTP request that injects an OS command into the 'ip' parameter, which is a classic exploit technique. It includes a function named 'exploit' that executes the payload and returns the output, demonstrating active exploitation rather than mere detection.
exploit.py:28-50Readme.md:3Requirements
- Target running OpenNetAdmin <=18.1.1 with the vulnerable endpoint accessible.
Readme.md:3 - Network access to the target URL.
exploit.py:18
Observed behavior
- Sends a POST request with a command injection payload in the 'xajaxargs[]' parameter to execute an arbitrary OS command.
exploit.py:30-37 - Extracts and prints the command output from the HTTP response using a unique separator.
exploit.py:42-46 - Optionally retrieves the OpenNetAdmin version by querying the app_about module.
exploit.py:10-23
Behaviors behind the backdoor verdict
Observables
- Command Injection Payload
- Payload withheldThe exploit constructs an OS command injection payload using a user-supplied command, delimited by a UUID separator to extract output. This is the expected exploit mechanism for CVE-2019-25065.
exploit.py:34 - Network Request
- Payload withheldThe script sends HTTP POST requests to the target URL with the injection payload. This is the standard delivery method for the exploit.
exploit.py:40
What the analysis did not establish
- The evidence does not include any authentication mechanism; the exploit appears to work without credentials, but the CVE context lists 'PR:L' (privileges required: low), which may indicate a discrepancy or that the exploit bypasses authentication.
- Only the two text files (Readme.md, exploit.py) were reviewed; no binary files were present.
- The behavior of the Python standard library and the 'requests' third-party library is assumed to be benign; their source code was not inspected.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubsagisar1/CVE-2019-25065-exploitRepository PoCby sagisar1Stars: 0Not analyzed2 files
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-25065 vuldb.com
https://vuldb.com/?id.146798