Metasploit Demo Meeting 2019-04-23
Channel: Metasploit
Date: 23/04/2019

The Rapid7 Metasploit development team discusses (and demonstrates!) ongoing Metasploit work and features during their bimonthly sprint meeting. 

This week's demo meeting covers the following new modules:

* Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF (CVE-2019-9670 and CVE-2019-9621; see last week's demo meeting recording for the demo!)
* Confluence Widget Connector Macro Vulnerability (CVE-2019-3396; and demo'd in this week's meeting!)
* Horde Form File Upload Vulnerability (CVE-2019-9858)
* WordPress Crop-image Shell Upload (CVE-2019-8942 and CVE-2019-8943)
* Cisco RV130(W) Routers Management Interface RCE (CVE-2019-1663)
* Microsoft Windows Contact File Format Arbitrary Code Execution (EDB-46188)
* LibreOffice Macro Code Execution (CVE-2018-16858; and demo'd in this week's meeting!)
* WordPress Google Maps Plugin SQL Injection (CVE-2019-10692)

And there's also a number of enhancements and bug fixes we cover, too!

See all the latest modules, PRs, Metasploit blogs, and contributors at https://metasploit.com.