Skip to content

Commit 18be9fc

Browse files
committed
Added suggestions from jvoisin
1 parent d52593f commit 18be9fc

File tree

2 files changed

+2
-12
lines changed

2 files changed

+2
-12
lines changed

documentation/modules/exploit/linux/http/craftcms_ftp_template.md

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
11
## Vulnerable Application
22

3-
This Metasploit module exploits a Remote Code Execution vulnerability in **Craft CMS** versions that fall within the following ranges:
4-
5-
- Versions `>= 5.0.0-RC1` and `< 5.5.2`
6-
- Versions `>= 4.0.0-RC1` and `< 4.13.2`
7-
- Versions `>= 3.0.0` and `< 3.9.14`
3+
This Metasploit module exploits a Remote Code Execution vulnerability in **Craft CMS**.
84

95
The vulnerability lies in improper handling of Twig templates, which can be exploited
106
to inject and execute arbitrary PHP code on the server via crafted HTTP requests.
@@ -30,7 +26,7 @@ Install a specific vulnerable version of Craft CMS:
3026
```bash
3127
mkdir exploit-craft && \
3228
cd exploit-craft && \
33-
# Configure DDEV project for Craft CMS
29+
# Configure DDEV (https://ddev.com/) project for Craft CMS \
3430
ddev config \
3531
--project-type=craftcms \
3632
--docroot=web \

lib/msf/core/exploit/remote/ftp_server.rb

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -74,19 +74,13 @@ def on_client_data(c)
7474
cmd,arg = data.strip.split(/\s+/, 2)
7575
arg ||= ""
7676

77-
# For testing purposes only
78-
print_status("<- #{cmd} #{arg}")
79-
8077
return if not cmd
8178

8279
# Allow per-command overrides
8380
if self.respond_to?("on_client_command_#{cmd.downcase}", true)
8481
return self.send("on_client_command_#{cmd.downcase}", c, arg)
8582
end
8683

87-
# Also for testing purposes only
88-
print_status("Received a command we don't have an override for: #{cmd}")
89-
9084
case cmd.upcase
9185
when 'USER'
9286
@state[c][:user] = arg

0 commit comments

Comments
 (0)