{"uuid": "a0288418-e39c-44c0-909d-f17c5fb194f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40845", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/23702", "content": "Exploit CollectorZenitel AlphaCom XE Audio Server 11.2.3.10 Shell Upload \n\n\nZenitel AlphaCom XE Audio Server versions up to 11.2.3.10 have a web interface called AlphaWeb XE that allows for a remote shell upload.\n\nMD5 | 6b53ff27b2a4d835007b117376d0f7c0\n\nDownload\n\n\n\n\nI. VULNERABILITY\n-------------------------\nAlphaWeb XE - Authenticated Insecure File Upload leading to RCE\n\n\nII. CVE REFERENCE\n-------------------------\nCVE-2021-40845\n\n\nIII. VENDOR\n-------------------------\nhttps://www.zenitel.com/\n\n\nIV. DESCRIPTION\n-------------------------\n\nThe web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.\n\nTo exploit this vulnerability, someone must authenticate in the server and access the \"Scripts\" button in the \"Custom scripts\" tab. \n\n![img1](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image1.png?raw=true)\n\nThen, the button \"Choose file\" is clicked and the file is uploaded clicking \"Upload\". \n\n![img3](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image3.png?raw=true)\n\nThe PHP test file is a simple one-line reverse shell:\n\n![img2](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image2.png?raw=true)\n\nThe new file, with the same name, extension and content is listed in the Scripts page:\n\n![img4](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image4.png?raw=true)\n\nThe path of these files is /cmd/$FILE$. Knowing the path, as there is not any restriction the file upload functionality, uploading a PHP reverse shell or cmdshell allows to get Remote Code Execution in the server:\n\n![img5](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image5.png?raw=true)\n\n\nV. REFERENCES\n-------------------------\nhttps://wiki.zenitel.com/wiki/AlphaWeb\nhttps://wiki.zenitel.com/wiki/AlphaWeb_Custom_Scripts\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40845\n\n\nVI. CREDIT\n-------------------------\nRicardo Jos\u00e9 Ruiz Fern\u00e1ndez (@ricardojoserf)\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:39.781325Z"}