Module library
All modules
Visit vidocsecurity.com
Ethical Hacking Automation
Automate Recon and scanning process with Vidoc. All security teams in one place
Start for free
3CX Management Console - Local File Inclusion
By kannthu
High
Vidoc Module
#3cx
#lfi
#voip
Description
Author: random-robbie
Classification
CWE-ID: CWE-22 CVSS-Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS-Score: 7.5 3CX Management Console is vulnerable to local file inclusion.
Reference
- https://medium.com/@frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88
Metadata
max-request: 2 shoda-query: http.title:"3CX Phone System Management Console"
Module preview
Concurrent Requests (1)
1. HTTP Request template
GET
/Electron/download/w...
/Electron/download/w...
Matching conditions
word: CfgServerPassword, CfgServerAppName
or
word: bit app support, fonts, extensions
Passive global matcher
No matching conditions.
On match action
Report vulnerability