automatic module_metadata_base.json update

Author: jenkins-metasploit

db/modules_metadata_base.json

@@ -106384,6 +106384,65 @@
     "session_types": false,
     "needs_cleanup": true
   },
+  "exploit_multi/http/roundcube_auth_rce_cve_2025_49113": {
+    "name": "Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization",
+    "fullname": "exploit/multi/http/roundcube_auth_rce_cve_2025_49113",
+    "aliases": [],
+    "rank": 600,
+    "disclosure_date": "2025-06-02",
+    "type": "exploit",
+    "author": [
+      "Maksim Rogov",
+      "Kirill Firsov"
+    ],
+    "description": "Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution\n          by authenticated users because the _from parameter in a URL is not validated\n          in program/actions/settings/upload.php, leading to PHP Object Deserialization.\n\n          An attacker can execute arbitrary system commands as the web server.",
+    "references": [
+      "CVE-2025-49113",
+      "URL-https://fearsoff.org/research/roundcube"
+    ],
+    "platform": "Linux,Unix",
+    "arch": "",
+    "rport": 80,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Linux Dropper",
+      "Linux Command"
+    ],
+    "mod_time": "2025-06-11 11:05:33 +0000",
+    "path": "/modules/exploits/multi/http/roundcube_auth_rce_cve_2025_49113.rb",
+    "is_install_path": true,
+    "ref_name": "multi/http/roundcube_auth_rce_cve_2025_49113",
+    "check": true,
+    "post_auth": true,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "SideEffects": [
+        "ioc-in-logs"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": true
+  },
   "exploit_multi/http/rudder_server_sqli_rce": {
     "name": "Rudder Server SQLI Remote Code Execution",
     "fullname": "exploit/multi/http/rudder_server_sqli_rce",