New module content (3)
cups-browsed Information Disclosure
Authors: bcoles and evilsocket
Type: Auxiliary
Pull request: #19510 contributed by bcoles
Path: scanner/misc/cups_browsed_info_disclosure
Description: Adds scanner module to retrieve CUPS version and kernel version information from cups-browsed services.
Acronis Cyber Infrastructure default password remote code execution
Authors: Acronis International GmbH and h00die-gr3y
Type: Exploit
Pull request: #19463 contributed by h00die-gr3y
Path: linux/http/acronis_cyber_infra_cve_2023_45249
AttackerKB reference: CVE-2023-45249
Description: This module exploits a default password vulnerability in Acronis Cyber Infrastructure (ACI) which allows an attacker to access the ACI PostgreSQL database and gain administrative access to the ACI Web Portal. This allows for the attacker to upload ssh keys that enables root access to the appliance/server. This attack can be remotely executed over the WAN as long as the PostgreSQL and SSH services are exposed to the outside world.
VICIdial Authenticated Remote Code Execution
Authors: Jaggar Henry of KoreLogic, Inc. and Valentin Lobstein
Type: Exploit
Pull request: #19456 contributed by Chocapikk
Path: unix/webapp/vicidial_agent_authenticated_rce
AttackerKB reference: CVE-2024-8504
Description: This adds a module to exploit CVE-2024-8504 an authenticated RCE in VICIdial.
Enhancements and features (3)
metasploit weekly
