Skip to content

Commit 49383f8

Browse files
author
Tod Beardsley
authored
Update and fix grammar to the CryptoLog module
After talking to the vendor, it appears that the PHP version of CryptoLog has been EOL'ed since 2009. It has since been replaced with an ASP.NET version, which, obviously, is no longer vulnerable to these PHP exposures.
1 parent b6fd0ce commit 49383f8

File tree

1 file changed

+11
-7
lines changed

1 file changed

+11
-7
lines changed

modules/exploits/linux/http/crypttech_cryptolog_login_exec.rb

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,20 @@ def initialize(info={})
1212
super(update_info(info,
1313
'Name' => "Crypttech CryptoLog Remote Code Execution",
1414
'Description' => %q{
15-
This module exploits the sql injection and command injection vulnerability of CryptoLog. An un-authenticated user can execute a
16-
terminal command under the context of the web user.
15+
This module exploits a SQL injection and command injection vulnerability in the PHP version of CryptoLog.
16+
An unauthenticated user can execute a terminal command under the context of the web user. These vulnerabilities
17+
are no longer present in the ASP.NET version CryptoLog, available since 2009.
1718
18-
login.php endpoint is responsible for login process. One of the user supplied parameter is used by the application without input validation
19-
and parameter binding. Which cause a sql injection vulnerability. Successfully exploitation of this vulnerability gives us the valid session.
19+
CryptoLog's login.php endpoint is responsible for the login process. One of the user supplied parameters is
20+
used by the application without input validation and parameter binding, which leads to SQL injection
21+
vulnerability. Successfully exploitating this vulnerability gives a the valid session.
2022
21-
logshares_ajax.php endpoint is responsible for executing an operation system command. It's not possible to access this endpoint without having
22-
a valid session. One user parameter is used by the application while executing operating system command which cause a command injection issue.
23+
CryptoLog's logshares_ajax.php endpoint is responsible for executing an operation system command. It's not
24+
possible to access this endpoint without having a valid session. One user parameter is used by the
25+
application while executing an operating system command, which causes a command injection issue.
2326
24-
Combining these vulnerabilities gives us opportunity execute operation system command under the context of the web user.
27+
Combining these vulnerabilities gives the opportunity execute operation system commands under the context
28+
of the web user.
2529
},
2630
'License' => MSF_LICENSE,
2731
'Author' =>

0 commit comments

Comments
 (0)