CVE-2020-15920

This exploit leverages an OS command injection vulnerability in Mida eFramework's PDC/ajaxreq.php endpoint, allowing remote code execution by injecting commands into the PARAM parameter. The PoC sends a crafted POST request with a command payload to execute arbitrary commands on the target system.

This Metasploit module exploits a command injection vulnerability in Mida Solutions eFramework's ajaxreq.php, allowing unauthenticated RCE as the apache user, which can then escalate to root via sudo misconfiguration. The exploit sends a crafted POST request with a malicious PARAM parameter to execute arbitrary commands.