{"uuid": "5bda02c4-74b0-491e-bc5f-ec5c4529cc0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34099", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/vicidial_user_authorization_unauth_cmd_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"bcoles \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in VICIdial versions\\n          2.9 RC 1 to 2.13 RC1 which allows unauthenticated users\\n          to execute arbitrary operating system commands as the web\\n          server user if password encryption is enabled (disabled\\n          by default).\\n\\n          When password encryption is enabled the user's password\\n          supplied using HTTP basic authentication is used in a call\\n          to exec().\\n\\n          This module has been tested successfully on version 2.11 RC2\\n          and 2.13 RC1 on CentOS.\", \"disclosure_date\": \"2017-05-26\", \"fullname\": \"exploit/unix/webapp/vicidial_user_authorization_unauth_cmd_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:59:12 +0000\", \"name\": \"VICIdial user_authorization Unauthenticated Command Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/unix/webapp/vicidial_user_authorization_unauth_cmd_exec.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/webapp/vicidial_user_authorization_unauth_cmd_exec\", \"references\": [\"CVE-2025-34099\", \"URL-http://www.vicidial.org/VICIDIALmantis/view.php?id=1016\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic Targeting\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:49.326257Z"}