Vinchin Backup And Recovery Command Injection

This Metasploit module exploits a command injection vulnerability in Vinchin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.*. Due to insufficient input validation in the checkIpExists API endpoint, an attacker can execute arbitrary commands as the web server user.

amp api attacker backup backup and recovery command command injection endpoint exploits injection input input validation metasploit recovery server the web validation vulnerability web web server