3CX Management Console - Local File Inclusion

By kannthu

High

Vidoc Module

#3cx#lfi#voip

Description

Author: random-robbie Classification CWE-ID: CWE-22 CVSS-Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS-Score: 7.5 3CX Management Console is vulnerable to local file inclusion. Reference - https://medium.com/@frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88 Metadata max-request: 2 shoda-query: http.title:"3CX Phone System Management Console"

Module preview

Concurrent Requests (1)

1. HTTP Request template

GET/Electron/download/w.../Electron/download/w...

Matching conditions

word: CfgServerPassword, CfgServerAppNameor

word: bit app support, fonts, extensions

Passive global matcher

No matching conditions.

On match action

Report vulnerability