CVE-2020-11546
CRITICAL EXPLOITED NUCLEISuperWebMailer < 7.40.0.01550 - Unauthenticated Remote Code Execution via Language Parameter
Title source: llmExploitation Summary
CVE-2020-11546 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including damit5, Official-BlackHat13. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a Go-based exploit for CVE-2020-11546, targeting a command injection vulnerability in SuperWebMailer. It automates the exploitation process by sending a crafted POST request to execute arbitrary commands via the 'Language' parameter.
Description
SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.
Exploits (2)
This is a Go-based exploit for CVE-2020-11546, targeting a command injection vulnerability in SuperWebMailer. It automates the exploitation process by sending a crafted POST request to execute arbitrary commands via the 'Language' parameter.
This is a functional exploit for CVE-2020-11546, a remote code execution vulnerability in SuperWebMailer. It leverages command injection via the `Language` parameter in a POST request to `mailingupgrade.php`.
Nuclei Templates (1)
title:"SuperWebMailer" || http.title:"superwebmailer"
title="superwebmailer"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H