IPFire_2.19_RCE_Authenticated

IPFire 2.19 OINKCODE 远程代码执行 PoC 针对 IPFire 2.19 的 ids.cgi 页面中通过 OINKCODE 参数存在的认证后命令注入漏洞的 Python 概念验证（PoC）。 仅供授权的安全测试和培训实验环境使用。 仅可针对您拥有或已获得明确测试许可的系统运行此 PoC。作者不对因使用此代码造成的滥用或损害负责。 漏洞概述 IPFire 2.19 在 /cgi-bin/ids.cgi 处理的 OINKCODE 参数中存在操作系统命令注入漏洞。该参数未经适当中和便被拼接到 shell 命令中，使已认证用户能够在 IPFire 主机上执行命令。...

PT-2026-29754

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs ids.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open call, which allows command injection due to an incomplete...

EUVD-2025-36525

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the IGNOREENTRYREMARK parameter when adding a whitelisted host. When a whitelisted host is added, an HTTP POST...

IPFire 'OINKCODE' Parameter Remote Command Injection Vulnerability

IPFire is prone to a remote command injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

IPFire ids.cgi OINKCODE Parameter Command Injection (CVE-2017-9757)

A command injection vulnerability exists in the ids.cgi script of IPFire. The vulnerability is due to incorrect handling of the OINKCODE HTTP parameter. A remote authenticated attacker may exploit this vulnerability by sending a crafted request to the vulnerable CGI script...

IPFire proxy.cgi Remote Code Execution Exploit

IPFire, a free linux based open source firewall distribution, version prior to 2.19 Update Core 110 contains a remote command execution vulnerability in the ids.cgi page in the OINKCODE field. This module requires Metasploit: http://metasploit.com/download Current source:...

CVE-2017-9757

IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF...

Command injection

IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF...

CVE-2017-9757

IPFire 2.19 contains a remote command injection vulnerability in the ids.cgi script via the OINKCODE parameter. The issue is triggered when the shell mishandles the input, allowing an attacker to execute commands. Exploitation can occur by authenticated users or via CSRF, according to CVE-2017-97...

IPFire proxy.cgi RCE

IPFire, a free linux based open source firewall distribution, version use exploit/linux/http/ipfire/oinkcodeexec msf undefinedoinkcodeexec show actions ...actions... msf undefinedoinkcodeexec set ACTION msf undefinedoinkcodeexec show options ...show and set options... msf undefinedoinkcodeexec ru...

IPFire 2.19 - Remote Code Execution

Title : IPFire 2.19 Firewall Post-Auth RCE Date : 09/06/2017 Author : 0x09AL https://twitter.com/0x09AL Tested on: IPFire 2.19 x8664 - Core Update 110 Vendor : http://www.ipfire.org/ Software : http://downloads.ipfire.org/releases/ipfire-2.x/2.19-core110/ipfire-2.19.x8664-full-core110.iso...