automatic module_metadata_base.json update

Author: jenkins-metasploit

db/modules_metadata_base.json

@@ -40870,6 +40870,61 @@
     "needs_cleanup": false,
     "actions": []
   },
+  "auxiliary_scanner/http/pretalx_file_read_cve_2023_28459": {
+    "name": "Pretalx Arbitrary File Read/Limited File Write",
+    "fullname": "auxiliary/scanner/http/pretalx_file_read_cve_2023_28459",
+    "aliases": [],
+    "rank": 300,
+    "disclosure_date": null,
+    "type": "auxiliary",
+    "author": [
+      "Stefan Schiller",
+      "msutovsky-r7"
+    ],
+    "description": "This module exploits functionality in Pretalx that export conference schedule as zipped file. The Pretalx will iteratively include any file referenced by any HTML tag and does not properly check the path of the file, which can lead to arbitrary file read. The module requires credentials that allow schedule export, schedule release and approval of proposals. Additionally, module requires conference name and URL for media files.",
+    "references": [],
+    "platform": "",
+    "arch": "",
+    "rport": 80,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": null,
+    "mod_time": "2025-08-22 15:26:46 +0000",
+    "path": "/modules/auxiliary/scanner/http/pretalx_file_read_cve_2023_28459.rb",
+    "is_install_path": true,
+    "ref_name": "scanner/http/pretalx_file_read_cve_2023_28459",
+    "check": true,
+    "post_auth": true,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs",
+        "artifacts-on-disk"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": false,
+    "actions": []
+  },
   "auxiliary_scanner/http/prev_dir_same_name_file": {
     "name": "HTTP Previous Directory File Scanner",
     "fullname": "auxiliary/scanner/http/prev_dir_same_name_file",
@@ -82004,6 +82059,65 @@
     "session_types": false,
     "needs_cleanup": null
   },
+  "exploit_linux/http/pretalx_rce_cve_2023_28458": {
+    "name": "Pretalx Limited File Write to Remote Code Execution",
+    "fullname": "exploit/linux/http/pretalx_rce_cve_2023_28458",
+    "aliases": [],
+    "rank": 600,
+    "disclosure_date": "2023-03-07",
+    "type": "exploit",
+    "author": [
+      "Stefan Schiller",
+      "msutovsky-r7"
+    ],
+    "description": "This module exploits CVE-2023-28458, a limited file write in Pretalx, up to version 2.3.1. The module will use the vulnerability to write a malicious site-specific configuration hook forPython. Once hook is written, payload will be executed every time Pretalx user runs any Python code. Pretalx needs to run in debug mode to exploit this.",
+    "references": [
+      "URL-https://www.sonarsource.com/blog/pretalx-vulnerabilities-how-to-get-accepted-at-every-conference/",
+      "CVE-2023-28458"
+    ],
+    "platform": "Linux,Unix",
+    "arch": "cmd",
+    "rport": 80,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Linux Target"
+    ],
+    "mod_time": "2025-08-22 15:26:46 +0000",
+    "path": "/modules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb",
+    "is_install_path": true,
+    "ref_name": "linux/http/pretalx_rce_cve_2023_28458",
+    "check": true,
+    "post_auth": true,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "artifacts-on-disk",
+        "ioc-in-logs"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_linux/http/progress_flowmon_unauth_cmd_injection": {
     "name": "Flowmon Unauthenticated Command Injection",
     "fullname": "exploit/linux/http/progress_flowmon_unauth_cmd_injection",