thecybergeek/cve-2019-19369Authenticated remote code execution exploit for FusionPBX versions <= 4.5.10, leveraging the PHP-Editor function to inject a payload and gain a shell as www-data.
Authenticated attackers can use PHP-Editor function in FusionPBX versions =< 4.5.10 to edit one of the existing PHP pages to insert a PHP payload. By navigating to the changed file we are able to gain a shell as www-data.
Discovered by TheCyberGeek
