.. / CVE-2020-24949

• RCE
• Nuclei
• Web

Exploit for PHP-Fusion 9.03.50 - Remote Code Execution (CVE-2020-24949)

Description:

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution.

Nuclei Template

View the template here CVE-2020-24949.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-24949.yaml

References: