Skip to content

Commit 5587250

Browse files
MaikuolanMaikuolan
committed
Modules update.
1 parent 99f8ef8 commit 5587250

File tree

4 files changed

+68
-25
lines changed

4 files changed

+68
-25
lines changed

‎modules/module_extras.php‎

Lines changed: 61 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Optional security extras module (last modified: 2025.07.16).
11+
* This file: Optional security extras module (last modified: 2025.07.17).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -77,21 +77,21 @@
7777
$CIDRAM['Reporter']->report([15], ['Caught probing for quarantined files.'], $CIDRAM['BlockInfo']['IPAddr']);
7878
} // 2017.03.22 mod 2023.08.13
7979

80-
/** Probing for unsecured backup files. */
80+
/** Probing for exposed backup files. */
8181
if ($Trigger(preg_match(
82-
'~(?:/backup|(?:archive|backup|docroot|htdocs|public_html|site|www)\.(?:gz|rar|tar(?:\.gz)?|zip)|d(?:atabase|b|ump)\.sql)(?:$|[/?])~',
82+
'~(?:(?:^|[/?])backup|(?:archive|backup|d(?:atabase|b|ocroot|ump)|htdocs|public_html|site|www)(?:\.(?:new\d*|old\d*|sql))*(?:\.(?:[7bg]z\d*|7?zip|b[ac]k|[rt]ar(?:\.gz)?|tgz))+)(?:$|[/?])~',
8383
$LCNrURI
84-
), 'Probing for unsecured backup files not allowed')) {
85-
$CIDRAM['Reporter']->report([15], ['Caught probing for unsecured backup files.'], $CIDRAM['BlockInfo']['IPAddr']);
86-
} // 2023.08.13 mod 2025.03.03
84+
), 'Probing for exposed backup files')) {
85+
$CIDRAM['Reporter']->report([15], ['Caught probing for exposed backup files.'], $CIDRAM['BlockInfo']['IPAddr']);
86+
} // 2023.08.13 mod 2025.07.17
8787

88-
/** Probing for unsecured SQL dumps. */
88+
/** Probing for exposed SQL dumps. */
8989
if ($Trigger(preg_match(
90-
'~^[^?]*[^/?]+\.sql(?:\.(?:b[ac]k|bz|new|old|t?gz|7?zip|[rt]ar))?(?:$|[/?])~',
90+
'~\.sql(?:\.(?:[7bg]z\d*|7?zip|b[ac]k|db\d*|new\d*|old\d*|[rt]ar|sql|tgz))*(?:$|[/?])~',
9191
$LCNrURI
92-
), 'Probing for unsecured SQL dumps not allowed')) {
93-
$CIDRAM['Reporter']->report([15], ['Caught probing for unsecured SQL dumps.'], $CIDRAM['BlockInfo']['IPAddr']);
94-
} // 2024.05.12
92+
), 'Probing for exposed SQL dumps')) {
93+
$CIDRAM['Reporter']->report([15], ['Caught probing for exposed SQL dumps.'], $CIDRAM['BlockInfo']['IPAddr']);
94+
} // 2024.05.12 mod 2025.07.17
9595

9696
/** Probing for unsecured WordPress configuration files. */
9797
if ($Trigger(preg_match(
@@ -156,25 +156,38 @@
156156
$CIDRAM['Reporter']->report([15, 20], ['Caught probing for webshells/backdoors. Host might be compromised.'], $CIDRAM['BlockInfo']['IPAddr']);
157157
}
158158

159-
/** Probing for vulnerable plugins or webapps. */
159+
/** Probing for common vulnerabilities and exploits. */
160160
if (
161+
$Trigger(preg_match('~/ecp/current/exporttool/microsoft.exchange.ediscovery.exporttool.application(?:$|[/?])~', $LCNrURI), $Exploit = 'CVE-2021-28481') || // 2025.07.17
161162
$Trigger(preg_match('~/util/php/eval-stdin\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'CVE-2017-9841') || // 2025.07.16
162163
$Trigger(preg_match('~/elfinder/php/connector\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'elFinder') || // 2025.07.07 (possible matches: CVE-2019-1010178, CVE-2020-25213, CVE-2020-35235, CVE-2021-32682)
163164
$Trigger(preg_match('~/tinymce/plugins/filemanager/dialog\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'TinyMCE Filemanager') || // 2025.07.07
164165
$Trigger(preg_match('~/civicrm/packages/openflashchart/php-ofc-library/ofc_upload_image\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'CIVI-SA-2013-001') || // 2025.07.05
165166
$Trigger(preg_match('~/library/openflashchart/php-ofc-library/ofc_upload_image\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'ZSL-2013-5126') || // 2025.07.10
166167
$Trigger(preg_match('~/includes/openflashchart/php-ofc-library/ofc_upload_image\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'SA53428') || // 2025.07.10
167168
$Trigger(preg_match('~/dup-installer/main\.installer\.php[57]?(?:$|[/?])~', $LCNrURI), $Exploit = 'CVE-2022-2551') || // 2024.09.05
168-
$Trigger(preg_match('~/Telerik\.Web\.UI\.WebResource\.axd(?:$|[/?])~i', $LCNrURI), $Exploit = 'CVE-2019-18935') || // 2024.10.30
169+
$Trigger(preg_match('~/Telerik\.Web\.UI\.WebResource\.axd(?:$|[/?])~i', $LCNrURI), $Exploit = 'CVE-2019-18935') // 2024.10.30
170+
) {
171+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for ' . $Exploit . ' vulnerability.'], $CIDRAM['BlockInfo']['IPAddr']);
172+
}
173+
174+
/** Probing for common vulnerabilities and exploits. */
175+
if (
176+
$Trigger(preg_match('~hello\.world\?(?:%ad|\xAD)d\+allow_url_include(?:%3d|=)1\+(?:%ad|\xAD)d~', $LCNrURI), $Exploit = 'CVE-2024-4577') || // 2025.07.17
169177
$Trigger(preg_match('~\?s=../%5c|invokefunction&function=call_user_func_array&|vars%5b0%5d=md5|vars%5b1%5d%5b%5d=hellothinkphp~', $LCNrURI), $Exploit = 'CVE-2018-20062') // 2025.07.01
170178
) {
171179
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for ' . $Exploit . ' vulnerability.'], $CIDRAM['BlockInfo']['IPAddr']);
172180
}
173181

174182
/** Probing for exposed Git data. */
175-
if ($Trigger(preg_match('~\.git(?:config)?(?:$|\W)~', $LCNrURI), 'Probing for exposed git data')) {
176-
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed git data.'], $CIDRAM['BlockInfo']['IPAddr']);
177-
} // 2022.06.05 mod 2025.04.28
183+
if ($Trigger(preg_match('~\.git(?:config)?(?:$|\W)~', $LCNrURI), 'Probing for exposed Git data')) {
184+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Git data.'], $CIDRAM['BlockInfo']['IPAddr']);
185+
} // 2022.06.05 mod 2025.07.17
186+
187+
/** Probing for exposed SVN data. */
188+
if ($Trigger(preg_match('~(?:^|[/?])\.svn(?:$|[/?])|\.svn/wc\.db(?:$|[/?])~', $LCNrURI), 'Probing for exposed SVN data')) {
189+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed SVN data.'], $CIDRAM['BlockInfo']['IPAddr']);
190+
} // 2025.07.17
178191

179192
/** Probing for exposed VSCode data. */
180193
if ($Trigger(preg_match('~(?:^|[/?])\.vscode(?:$|\W)~', $LCNrURI), 'Probing for exposed VSCode data')) {
@@ -196,15 +209,45 @@
196209
$CIDRAM['Reporter']->report([15], ['Caught probing for exposed FTP credentials.'], $CIDRAM['BlockInfo']['IPAddr']);
197210
} // 2025.03.09
198211

212+
/** Probing for exposed FrontPage file credential dumps. */
213+
if ($Trigger(preg_match('~(?:^|[/?])_vti_pvt/service\.pwd(?:$|[/?])~', $LCNrURI), 'Probing for exposed FrontPage file credential dumps')) {
214+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed FrontPage file credential dumps.'], $CIDRAM['BlockInfo']['IPAddr']);
215+
} // 2025.07.17
216+
217+
/** Probing for exposed server private keys. */
218+
if ($Trigger(preg_match('~(?:^|[/?])private/server\.key(?:$|[/?])~', $LCNrURI), 'Probing for exposed server private keys')) {
219+
$CIDRAM['Reporter']->report([15], ['Caught probing for exposed server private keys.'], $CIDRAM['BlockInfo']['IPAddr']);
220+
} // 2025.07.17
221+
222+
/** Probing for exposed Ansible service credentials. */
223+
if ($Trigger(preg_match('~(?:^|[/?])user_secrets\.yml(?:$|[/?])~', $LCNrURI), 'Probing for exposed Ansible service credentials')) {
224+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Ansible service credentials.'], $CIDRAM['BlockInfo']['IPAddr']);
225+
} // 2025.07.17
226+
227+
/** Probing for exposed Visual Studio secrets. */
228+
if ($Trigger(preg_match('~(?:^|[/?])secrets\.json(?:$|[/?])~', $LCNrURI), 'Probing for exposed Visual Studio secrets')) {
229+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed Visual Studio secrets.'], $CIDRAM['BlockInfo']['IPAddr']);
230+
} // 2025.07.17
231+
232+
/** Probing for exposed Rails database schema state capture file. */
233+
if ($Trigger(preg_match('~(?:^|[/?])db/schema\.rb(?:$|[/?])~', $LCNrURI), 'Probing for exposed Rails database schema state capture file')) {
234+
$CIDRAM['Reporter']->report([15], ['Caught probing for exposed Rails database schema state capture file.'], $CIDRAM['BlockInfo']['IPAddr']);
235+
} // 2025.07.17
236+
237+
/** Probing for exposed cloud-init configuration file. */
238+
if ($Trigger(preg_match('~(?:^|[/?])cloud-config\.yml(?:$|[/?])~', $LCNrURI), 'Probing for exposed cloud-init configuration file')) {
239+
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for exposed cloud-init configuration file.'], $CIDRAM['BlockInfo']['IPAddr']);
240+
} // 2025.07.17
241+
199242
/** Probing for vulnerable routers. */
200243
if ($Trigger(preg_match('~(?:^|\W)HNAP1~i', $LCNrURI), 'Probing for vulnerable routers')) {
201244
$CIDRAM['Reporter']->report([15, 23], ['Caught probing for vulnerable routers.'], $CIDRAM['BlockInfo']['IPAddr']);
202245
} // 2022.06.05
203246

204247
/** Probing for vulnerable webapps. */
205-
if ($Trigger(preg_match('~cgi-bin/(?:get_status|(?:web)?login)\.cgi(?:$|\?)|manager/text/list~', $LCNrURI), 'Probing for vulnerable webapps')) {
248+
if ($Trigger(preg_match('~cgi-bin/(?:get_status|(?:web)?login)\.cgi(?:$|[/?])|(?:^|[/?])manager/text/list~', $LCNrURI), 'Probing for vulnerable webapps')) {
206249
$CIDRAM['Reporter']->report([15, 21], ['Caught probing for vulnerable webapps.'], $CIDRAM['BlockInfo']['IPAddr']);
207-
} // 2022.06.05 mod 2025.03.03
250+
} // 2022.06.05 mod 2025.07.17
208251

209252
/** Probing for sendgrid env file. */
210253
if ($Trigger(preg_match('~(?:^|[/?])sendgrid\.env(?:$|[/?])~', $LCNrURI), 'Probing for sendgrid env file')) {

‎modules/modules.dat‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ module_cookies.php:
239239
module_extras.php:
240240
Name: "Optional security extras module"
241241
False Positive Risk: "Medium"
242-
Version: "2025.196.0"
242+
Version: "2025.198.0"
243243
Dependencies:
244244
PHP: "^5.4|^7|^8"
245245
CIDRAM Core: "^1.13.1|^2.0.1"
@@ -254,7 +254,7 @@ module_extras.php:
254254
- "module_extras.php"
255255
- "module_extras.yaml"
256256
Checksum:
257-
- "ec6563aced186a56afdb236c48560592a8b53e7cf5cc240874d1d0259cc230bc:33539"
257+
- "850f4b2a28118c973e80e0d504aacb8be3b9de325d61232b870e2abc7c44bf1a:36753"
258258
- "7b891d1fa4b1c52c410220bc758e8cb7064bd6040430fb149a5b60e9ae2e0838:890"
259259
Used with: "modules"
260260
Reannotate: "modules.dat"

‎modules/modules.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,11 +53,11 @@ PHPMailer:
5353
Referrer spam module:
5454
Name: "Referrer spam module"
5555
False Positive Risk: "Medium"
56-
Version: "2023.334.0"
56+
Version: "2025.197.0"
5757
Dependencies:
5858
intl: "*"
5959
Files:
6060
modules/refspam.php:
6161
From: "https://raw.githubusercontent.com/CIDRAM/CIDRAM-Extras/master/modules/refspam.php"
62-
Checksum: "210838ecee50b04e8153dfd6f51c558f1e53dfa125f0ef6d3675a0907735cb49:12834"
62+
Checksum: "00922342042389bf9e19eee0ae67b957ed46e08d272a5d54c09b101c3275cbf5:12899"
6363
Used with: "modules"

‎modules/refspam.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
* License: GNU/GPLv2
99
* @see LICENSE.txt
1010
*
11-
* This file: Referrer spam module (last modified: 2023.12.01).
11+
* This file: Referrer spam module (last modified: 2025.07.17).
1212
*
1313
* False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
1414
*/
@@ -36,8 +36,8 @@
3636
/** Lower-case domain part. */
3737
$RefLC = strtolower($Domain);
3838

39-
/** Convert punycode to UTF-8. */
40-
if (strpos($RefLC, 'xn--') !== false) {
39+
/** Convert punycode to UTF-8 (as long as Intl is available). */
40+
if (strpos($RefLC, 'xn--') !== false && function_exists('idn_to_utf8')) {
4141
$Domain = explode('.', $Domain);
4242
foreach ($Domain as &$DomainPart) {
4343
if (strtolower(substr($DomainPart, 0, 4)) !== 'xn--') {

0 commit comments

Comments
 (0)