Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-34099.
PoCs published by Metasploit, including Metasploit module exploits/unix/webapp/vicidial_user_authorization_unauth_cmd_exec.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated command execution vulnerability in VICIdial versions 2.9 RC 1 to 2.13 RC1 by injecting commands into the HTTP Basic authentication password field when password encryption is enabled. The exploit leverages improper input sanitization to execute arbitrary commands as the web server user.
Description
An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated in 2017.
Exploits (2)
This Metasploit module exploits an unauthenticated command execution vulnerability in VICIdial versions 2.9 RC 1 to 2.13 RC1 by injecting commands into the HTTP Basic authentication password field when password encryption is enabled. The exploit leverages improper input sanitization to execute arbitrary commands as the web server user.
This Metasploit module exploits an unauthenticated command execution vulnerability in VICIdial versions 2.9 RC 1 to 2.13 RC1 when password encryption is enabled. It leverages HTTP Basic Authentication to inject commands via the password field, which is passed to an exec() call.
References (4)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N