Spring Exploits
This weekly release of Metasploit Framework includes new RCE exploit modules for several vulnerable applications: Appsmith, a low-code application platform which contains a misconfiguration on PostgreSQL (CVE-2024-55964); Pandora FMS, a monitoring solution, where, once gained access to the administrator panel is possible to inject commands (CVE-2024-12971); Oracle Access Manager, a SSO application containing an unauthenticated deserialization vulnerability (CVE-2021-35587); and pgAdmin Query Tool, a powerful database management tool that let attacker convert database accesses into shells (CVE-2025-2945).
New module content (5)
CrushFTP AWS4-HMAC Authentication Bypass
Authors: Outpost24 and remmons-r7
Type: Auxiliary
Pull request: #20000 contributed by remmons-r7
Path: gather/crushftp_authbypass_cve_2025_2825
AttackerKB reference: CVE-2025-2825
Description: Adds an auxiliary module leveraging CVE-2025-2825, an authentication bypass in CrushFTP 11 < 11.3.1 and 10 < 10.8.4, to obtain working session cookies for the target user account.
Appsmith RCE
Authors: Takahiro Yokoyama and Whit Taylor (Rhino Security Labs)
Type: Exploit
Pull request: #20007 contributed by Takahiro-Yoko
Path: linux/http/appsmith_rce_cve_2024_55964
AttackerKB reference: CVE-2024-55964
Description: This module adds an exploit for CVE-2024-55964, a misconfigured PostgreSQL instance in Appsmith, which can lead to remote code execution (RCE).
Pandora FMS authenticated command injection leading to RCE via chromium_path or phantomjs_bin
Author: h00die-gr3y(https://github.com/h00die-gr3y)
Type: ..
Support the originator by clicking the read the rest link below.
