Exploitation Summary
EIP tracks 1 public exploit for CVE-2025-30004.
PoCs published by Valentin Lobstein, including Metasploit module exploits/linux/http/xorcom_completepbx_scheduler.
AI-analyzed exploit summary This Metasploit module exploits an authenticated command injection vulnerability in Xorcom CompletePBX's task scheduler. It creates a malicious task with a payload-encoded command, executes it, and cleans up by deleting the task.
Description
Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35
Exploits (1)
This Metasploit module exploits an authenticated command injection vulnerability in Xorcom CompletePBX's task scheduler. It creates a malicious task with a payload-encoded command, executes it, and cleans up by deleting the task.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H