CVE-2024-8503
CRITICAL EXPLOITED NUCLEIVICIdial Authenticated Remote Code Execution
Title source: metasploitExploitation Summary
CVE-2024-8503 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 4 public exploits from researchers including Chocapikk, Machine-farmer, Valentin Lobstein, Jaggar Henry of KoreLogic, Inc., including a Metasploit module auxiliary/scanner/http/vicidial_sql_enum_users_pass.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-8503 (SQLi) and CVE-2024-8504 (RCE) in VICIdial. The exploit allows unauthenticated SQL injection to retrieve admin credentials and authenticated RCE via poisoned recording files.
Description
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
Exploits (4)
This repository contains a functional exploit for CVE-2024-8503 (SQLi) and CVE-2024-8504 (RCE) in VICIdial. The exploit allows unauthenticated SQL injection to retrieve admin credentials and authenticated RCE via poisoned recording files.
The repository contains a functional Python-based PoC for CVE-2024-8503, an unauthenticated blind SQL injection vulnerability in VICIdial's VERM_AJAX_functions.php. The tool includes state management for resumable scans, metadata extraction, and strict limits to prevent abuse.
This Metasploit module exploits a time-based SQL injection vulnerability in VICIdial to enumerate admin credentials (usernames and passwords) from the 'vicidial_users' table. It uses a blind SQL injection technique with a delay-based payload to extract data.
This Metasploit module exploits an authenticated RCE vulnerability in VICIdial (CVE-2024-8504) by chaining multiple steps, including authentication, privilege escalation, and payload delivery via a malicious recording. It requires admin credentials and leverages cron job execution for command execution as root.
Nuclei Templates (1)
icon_hash="1375401192"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H