PT-2024-39061 · Vicidial · Vicidial

Jaggar Henry · Published 2024-07-05 · Updated 2025-11-21 · CVE-2024-8504

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VICIdial (affected versions not specified)

Description An authenticated attacker with agent access can execute arbitrary shell commands as the root user. This issue can be chained with another issue to execute arbitrary shell commands without authentication. The vulnerability relates to a lack of protection for the SQL query structure within the VERM AJAX functions.php script. Exploitation may allow a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

OS Command Injection

Weakness Enumeration

CWE-89

CWE-78

Related Identifiers

BDU:2025-02024

CVE-2024-8504

Affected Products

Vicidial

References · 39

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/vicidial_agent_authenticated_rce.rb · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2024-8504 · Exploit
• 🔥 https://github.com/havokzero/ViciDial · Exploit
• https://bdu.fstec.ru/vul/2025-02024 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-8504 · Security Note
• https://t.me/p0x3k/1934 · Telegram Post
• https://twitter.com/Turtandazxc/status/1835369441405681878 · Twitter Post
• https://twitter.com/DarkWebInformer/status/1835087408724926522 · Twitter Post
• https://twitter.com/moton/status/1836027858340155470 · Twitter Post
• https://twitter.com/ptracesecurity/status/1835430929336009205 · Twitter Post
• https://twitter.com/ksg93rd/status/1835767337430987215 · Twitter Post
• https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt · Note
• https://twitter.com/WhichbufferArda/status/1864735776413540600 · Twitter Post
• https://t.me/pentestingnews/51436 · Telegram Post
• https://twitter.com/CeptBiro/status/1836393174626955270 · Twitter Post