File tree Expand file tree Collapse file tree 2 files changed +2
-12
lines changed
documentation/modules/exploit/linux/http
lib/msf/core/exploit/remote Expand file tree Collapse file tree 2 files changed +2
-12
lines changed Original file line number Diff line number Diff line change 11## Vulnerable Application
22
3- This Metasploit module exploits a Remote Code Execution vulnerability in ** Craft CMS** versions that fall within the following ranges:
4-
5- - Versions ` >= 5.0.0-RC1 ` and ` < 5.5.2 `
6- - Versions ` >= 4.0.0-RC1 ` and ` < 4.13.2 `
7- - Versions ` >= 3.0.0 ` and ` < 3.9.14 `
3+ This Metasploit module exploits a Remote Code Execution vulnerability in ** Craft CMS** .
84
95The vulnerability lies in improper handling of Twig templates, which can be exploited
106to inject and execute arbitrary PHP code on the server via crafted HTTP requests.
@@ -30,7 +26,7 @@ Install a specific vulnerable version of Craft CMS:
3026``` bash
3127mkdir exploit-craft && \
3228cd exploit-craft && \
33- # Configure DDEV project for Craft CMS
29+ # Configure DDEV (https://ddev.com/) project for Craft CMS \
3430ddev config \
3531 --project-type=craftcms \
3632 --docroot=web \
Original file line number Diff line number Diff line change @@ -74,19 +74,13 @@ def on_client_data(c)
7474 cmd , arg = data . strip . split ( /\s +/ , 2 )
7575 arg ||= ""
7676
77- # For testing purposes only
78- print_status ( "<- #{ cmd } #{ arg } " )
79-
8077 return if not cmd
8178
8279 # Allow per-command overrides
8380 if self . respond_to? ( "on_client_command_#{ cmd . downcase } " , true )
8481 return self . send ( "on_client_command_#{ cmd . downcase } " , c , arg )
8582 end
8683
87- # Also for testing purposes only
88- print_status ( "Received a command we don't have an override for: #{ cmd } " )
89-
9084 case cmd . upcase
9185 when 'USER'
9286 @state [ c ] [ :user ] = arg
You can’t perform that action at this time.
0 commit comments