CVE-2020-11108: Unrestricted Upload of File with Dangerous Type

The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges t...

Exploit for OS Command Injection in Pi-Hole

CVE-2020-8816 A Python script to exploit CVE-2020-8816, a remo...

Pi-Hole heisenbergCompensator Blocklist OS Command Execution

This exploits a command execution in Pi-Hole use exploit/unix/http/pihole/blocklistexec msf undefinedblocklistexec show actions ...actions... msf undefinedblocklistexec set ACTION msf undefinedblocklistexec show options ...show and set options... msf undefinedblocklistexec run This module require...

Pi-hole < 4.4 - Authenticated Remote Code Execution

!/usr/bin/env python3 Pi-hole = 4.4 RCE Author: Nick Frichette Homepage: https://frichetten.com Note: This exploit must be run with root privileges and port 80 must not be occupied. While it is possible to exploit this from a non standard port, for the sake of simplicity and not having to modify...

Pi-hole < 4.4 - Authenticated Remote Code Execution / Privileges Escalation

!/usr/bin/env python3 Pi-hole = 4.4 RCE Author: Nick Frichette Homepage: https://frichetten.com Note: This exploit must be run with root privileges and port 80 must not be occupied. While it is possible to exploit this from a non standard port, for the sake of simplicity and not having to modify...

Pi-hole 4.4 Remote Code Execution

!/usr/bin/env python3 Pi-hole = 4.4 RCE Author: Nick Frichette Homepage: https://frichetten.com Note: This exploit must be run with root privileges and port 80 must not be occupied. While it is possible to exploit this from a non standard port, for the sake of simplicity and not having to modify...

Pi-hole 4.4 Remote Code Execution / Privilege Escalation

!/usr/bin/env python3 Pi-hole = 4.4 RCE Author: Nick Frichette Homepage: https://frichetten.com Note: This exploit must be run with root privileges and port 80 must not be occupied. While it is possible to exploit this from a non standard port, for the sake of simplicity and not having to modify...

Exploit for Unrestricted Upload of File with Dangerous Type in Pi-Hole

CVE-2020-11108-PoC Two PoCs are in this repo. cve-2020-11108...

Pi-hole Remote Code Execution Vulnerability

Pi-Hole is a DNS server specialized in content filtering and also functions as a DHCP server. Pi-Hole suffers from a remote code execution vulnerability that can be exploited by an attacker to execute arbitrary commands against the server...

Pi-hole Web Interface < 4.3.3 RCE Vulnerability

The Pi-hole Web Interface previously AdminLTE is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Pi-Hole DHCP MAC OS Command Execution

This exploits a command execution in Pi-Hole use exploit/unix/http/pihole/dhcpmacexec msf undefineddhcpmacexec show actions ...actions... msf undefineddhcpmacexec set ACTION msf undefineddhcpmacexec show options ...show and set options... msf undefineddhcpmacexec run This module requires...

PT-2020-6849

Name of the Vulnerable Software and Affected Versions Pi-hole Web version 4.3.2 Description The issue allows remote code execution by privileged dashboard users via a crafted DHCP static lease. This is due to the failure to neutralize special elements used in the operating system command...

Pi-Hole Operating System Command Injection Vulnerability

Pi-Hole is a web-grade ad-blocking application. An operating system command injection vulnerability exists in Pi-Hole version 4.3. The vulnerability arises when a network system or product fails to properly filter special characters, commands, etc. during the construction of executable operating...

Exploit for OS Command Injection in Pi-Hole

Pi-Hole /tmp/pocproof.txt"@example.com !Screenshot 1i...

CVE-2019-13051

Pi-Hole 4.3 allows Command Injection...

CVE-2019-13051

Pi-Hole 4.3 allows Command Injection...

Command injection

Pi-Hole 4.3 allows Command Injection...

CVE-2019-13051

Pi-Hole 4.3 allows Command Injection...

CVE-2019-13051

Pi-hole 4.3 contains a vulnerability that allows command injection. The Red Hat/CNVD/NVD entries describe an OS command injection vulnerability arising when Pi-hole constructs executable OS commands from external input without proper filtering of special characters. The impact is high on confiden...

PT-2019-13097

Name of the Vulnerable Software and Affected Versions Pi-Hole version 4.3 Description The issue allows for Command Injection. Recommendations For Pi-Hole version 4.3, update to a newer version that contains a fix for this issue...