CVE-2025-34115

This exploit demonstrates a Remote Command Execution (RCE) vulnerability in op5 Monitor v7.1.9 via a CSRF entry point in the 'cmd_str' parameter of 'command_test.php'. The PoC uses a GET request to execute arbitrary commands, such as reading '/etc/passwd' and exfiltrating the data via netcat.

This Metasploit module exploits a command injection vulnerability in op5 Monitor v7.1.9 and below by abusing the 'Test this command' feature in the configuration page to execute arbitrary commands as an unprivileged user. It includes authentication handling and a cmdstager for payload delivery.