Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-107317. PoCs published by Dustin Cobb.
AI-analyzed exploit summary This exploit leverages a combination of XSS (CVE-2019-11408) and command injection (CVE-2019-11409) in FusionPBX <= 4.4.3 to achieve remote code execution. It sends a maliciously crafted SIP INVITE packet with an XSS payload in the 'From' field, which triggers a reverse shell via the exec.php script.
Description
FusionPBX 4.4.3 - Remote Command Execution
Exploits (1)
This exploit leverages a combination of XSS (CVE-2019-11408) and command injection (CVE-2019-11409) in FusionPBX <= 4.4.3 to achieve remote code execution. It sends a maliciously crafted SIP INVITE packet with an XSS payload in the 'From' field, which triggers a reverse shell via the exec.php script.