Dell Unity contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-7388 is an OS command injection vulnerability in Progress OpenEdge that allows authenticated remote attackers to execute system commands in the context of NT AUTHORITY/SYSTEM. This module can also use CVE-2024-1403, an authentication bypass vulnerability that allow access to the adminServer classes so can chain it with CVE-2025-7388 OS command injection.
A XML External Entity vulnerability combined with an authenticated OS command injection in SysAid on-prem allows unauthenticated remote attackers to leak arbitrary files wich may lead to the execution of OS system commands.
A message header injection vulnerability in Apache Camel allows unauthenticated remote attackers to execute OS system commands.
This issue allows unauthenticated users to execute arbitrary commands on the server due to a command injection vulnerability in the `cmd_realtime.php` file. The vulnerability arises when the `register_argc_argv` option of PHP is enabled, which is the default setting in many environments. The `$poller_id` used in command execution is sourced from `$_SERVER['argv']`, which can be manipulated through URLs when this option is enabled. This module exploits this vulnerability sending a special request to 'cmd_realtime.php' that sets $_SERVER['argv'] into an os command.
This update improves the module description and messages in the Module Output panel.
An authentication bypass in Palo Alto Networks PAN-OS software(CVE-2024-0012) enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions. A privilege escalation vulnerability in Palo Alto Networks PAN-OS software(CVE-2024-9474) allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. This module exploits these two vulnerabilities CVE-2024-0012 and CVE-2024-9474 in order to deploy an agent. The exploit does the following steps: Send a request containing a header parameter for authentication bypass(CVE-2024-0012) to inject a command within a 'user' request body parameter(CVE-2024-9474) and receive an elevated user session ID in the response, whereby the injected command is written to a local session cache file. Send a request with the elevated session ID to trigger evaluation of the injected local session cache file. Repeat the process with all the necessary commands to deploy an agent.
This module exploits CVE-2024-5910 to reset the password of the admin. For doing this, it will craft a special request to the endpoint /OS/startup/restore/restoreAdmin.php. After getting the admin password, it will authenticate with the admin credentials and it will exploit CVE-2024-9464 in order to deploy an agent. The exploitation of CVE-2024-9464 consists in crafting a special request to the endpoint /bin/CronJobs.php. As an authenticated user we can abuse this endpoint for inserting commands in the table cronjobs from pandb. After inserting the command into this table, the target will execute it.
In PHP, when using Apache and PHP-CGI on Windows and if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow remote attackers to pass options to PHP binary being run, leading to execute system commands in the context of the affected application.