CVE-2024-8503

This repository contains a functional exploit for CVE-2024-8503 (SQLi) and CVE-2024-8504 (RCE) in VICIdial. The exploit allows unauthenticated SQL injection to retrieve admin credentials and authenticated RCE via poisoned recording files.

This Metasploit module exploits a time-based SQL injection vulnerability in VICIdial to enumerate admin credentials (usernames and passwords) from the 'vicidial_users' table. It uses a blind SQL injection technique with a delay-based payload to extract data.

This Metasploit module exploits an authenticated RCE vulnerability in VICIdial (CVE-2024-8504) by chaining multiple steps, including authentication, privilege escalation, and payload delivery via a malicious recording. It requires admin credentials and leverages cron job execution for command execution as root.