CVE-2024-9441
CRITICALLinear eMerge e3-Series <1.00-07 - Command Injection
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-9441. PoCs published by p33d, adhikara13, jk-mayne.
AI-analyzed exploit summary This PoC exploits a command injection vulnerability in a PHP-based web application's forgot password functionality to achieve remote code execution. It injects a PHP shell into the server and executes arbitrary commands via base64-encoded POST requests.
Description
The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary OS commands via the login_id parameter when invoking the forgot_password functionality over HTTP.
Exploits (3)
This PoC exploits a command injection vulnerability in a PHP-based web application's forgot password functionality to achieve remote code execution. It injects a PHP shell into the server and executes arbitrary commands via base64-encoded POST requests.
This repository contains a functional PoC exploit for CVE-2024-9441, targeting Nortek Linear eMerge E3 systems. The exploit leverages a flaw in the password recovery feature to inject malicious PHP code, enabling pre-authentication remote code execution.
This Python script checks for CVE-2024-9441 by sending a command injection payload in the 'login_id' parameter and comparing response times to detect vulnerability. It uses a time-based approach to infer command execution.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H