CVE-2016-15048

AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An attacker can insert shell metacharacters into the ip parameter to inject and execute arbitrary system commands as the web server user. The initial third-party disclosure in 2016 recommended contacting the vendor for remediation guidance. Additionally, this product may have been rebranded under a different name. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-14 at 04:45:53.510819 UTC.

• CWE-78

• https://github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/remote_code_execution/hiboss-rce_2.yaml#L21Product
• https://wooyun.laolisafe.com/bug_detail.php?wybug_id=wooyun-2016-0181444Exploit, Issue Tracking, Third Party Advisory
• https://www.amttgroup.com/Product
• https://www.cnvd.org.cn/flaw/show/CNVD-2021-37784Issue Tracking
• https://www.vulncheck.com/advisories/amtt-hibos-command-injection-rce-via-server-ping-phpThird Party Advisory

Published

Oct 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-15042The Frontend File Manager (versions < 4.0), N-Media Post Fro…9.8
• CVE-2016-15043The WP Mobile Detector plugin for WordPress is vulnerable to…9.8
• CVE-2016-15044A remote code execution vulnerability exists in Kaltura vers…9.3
• CVE-2016-15045A local privilege escalation vulnerability exists in lastore…8.5
• CVE-2016-15046A client-side remote code execution vulnerability exists in …8.6
• CVE-2016-15047AVTECH devices that include the CloudSetup.cgi management en…8.7
• CVE-2016-15049Nagios Log Server versions prior to 1.4.2 are vulnerable to …5.4
• CVE-2016-1505The filesystem storage backend in Radicale before 1.1 on Win…
• CVE-2016-15050Nagios XI versions prior to 5.2.4 contain a SQL injection vu…8.8
• CVE-2016-15051Nagios XI versions prior to 5.2.4 are vulnerable to cross-si…5.4
• CVE-2016-15052Nagios XI versions prior to 5.2.4 are vulnerable to cross-si…5.4
• CVE-2016-15053Nagios XI versions prior to 5.2.4 are vulnerable to cross-si…5.4