CVE-2014-5112

published 2014-07-28

CVE-2014-5112: maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter.

Priority P2 61 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter.

Detection & IOCs extracted from sources · hover to see the quote

path /maint/modules/home/index.php↗

path /maint/modules/home/shell.php↗

filename shell.php↗

command lang=MF;echo " $Greats 2 MY="Love:D">shell.php↗

• → Monitor HTTP requests to /maint/modules/home/index.php for shell metacharacters (e.g., semicolons, pipes, redirects) in the 'lang' parameter, which indicate command injection attempts. ↗
• → Detect web shell drop attempts: look for creation of shell.php under the /maint/modules/home/ directory, particularly written via output redirection from the lang parameter. ↗
• → Alert on HTTP requests to /maint/modules/home/shell.php with a 'cmd' parameter, indicating post-exploitation web shell usage running as the 'asterisk' user. ↗

• · The exploit PoC uses example.com as a placeholder; the actual target path /maint/modules/home/index.php is relative to the trixbox installation root and may vary by deployment. ↗
• · The dropped web shell (shell.php) is written into the same /maint/modules/home/ directory as the vulnerable script, meaning the web server process (asterisk, uid=100) must have write permissions to that directory for the attack to succeed. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94