module
Xorcom CompletePBX Authenticated File Disclosure via Backup Download
| Disclosed |
|---|
| Mar 2, 2025 |
Disclosed
Mar 2, 2025
Description
This module exploits an authenticated file disclosure vulnerability in CompletePBX
The issue resides in the backup download function, where user input is not properly validated,
allowing an attacker to access arbitrary files on the system as root.
The vulnerability is triggered by setting the `backup` parameter to a Base64-encoded
absolute file path, prefixed by a comma `,`. This results in the server exposing the
file contents directly.
The issue resides in the backup download function, where user input is not properly validated,
allowing an attacker to access arbitrary files on the system as root.
The vulnerability is triggered by setting the `backup` parameter to a Base64-encoded
absolute file path, prefixed by a comma `,`. This results in the server exposing the
file contents directly.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.