CVE-2020-16152

This is a Metasploit module for CVE-2020-16152, targeting an authenticated RCE vulnerability in the WordPress Popular Posts plugin (<=5.3.2). It exploits improper input validation to upload a malicious PHP payload disguised as a GIF image, achieving remote code execution.

This PoC exploits a Local File Inclusion (LFI) vulnerability in Aerohive/Extreme Networks HiveOS via path truncation and log poisoning to achieve remote code execution (RCE) as root. The exploit leverages an outdated PHP version (5.2.17) to truncate the file path suffix and include arbitrary files.

This Metasploit module exploits CVE-2020-16152, combining LFI and log poisoning in Aerohive NetConfig to achieve unauthenticated RCE as root. It leverages PHP string truncation and log injection to execute arbitrary commands.