rapid7/metasploit-framework — pull request #1081 by wchen-r7 (2012-11-19 21:14:40+00:00)
Title: Add Narcissus module (OSVDB-87410)

This module exploits a vulnerability found in Narcissus' image configuration function. This is due to the backend.php file not handling the $release parameter properly, and then passes it on to the configure_image() function. In this function, the $release parameter can be used to inject system commands for passthru (a PHP function that's meant to be used to run a bash script by the vulnerable application), which allows remote code execution under the context of the web server.