CVE-2025-34116
HIGHIPFire < 2.19 Core Update 101 - Authenticated Remote Command Execution via proxy.cgi NCSA User Creation Form
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-34116.
PoCs published by Yann CAM, h00die <[email protected]>, Yann CAM, including Metasploit module exploits/linux/http/ipfire_proxy_exec.
AI-analyzed exploit summary The exploit demonstrates a multi-stage attack on IPFire < 2.19 Core Update 101, combining XSS, CSRF bypass, and command injection in proxy.cgi to achieve remote command execution. It includes detailed PoC code for each stage, culminating in a reverse shell via AWK.
Description
A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can inject arbitrary shell commands through crafted values in the NCSA user creation form fields, leading to command execution with web server privileges.
Exploits (2)
The exploit demonstrates a multi-stage attack on IPFire < 2.19 Core Update 101, combining XSS, CSRF bypass, and command injection in proxy.cgi to achieve remote command execution. It includes detailed PoC code for each stage, culminating in a reverse shell via AWK.
This Metasploit module exploits a remote command execution vulnerability in IPFire's proxy.cgi page by injecting a payload into the user creation form. The exploit leverages command injection via the password field to achieve RCE on vulnerable versions.
References (6)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N