@@ -12,16 +12,20 @@ def initialize(info={})
12
12
super ( update_info ( info ,
13
13
'Name' => "Crypttech CryptoLog Remote Code Execution" ,
14
14
'Description' => %q{
15
- This module exploits the sql injection and command injection vulnerability of CryptoLog. An un-authenticated user can execute a
16
- terminal command under the context of the web user.
15
+ This module exploits a SQL injection and command injection vulnerability in the PHP version of CryptoLog.
16
+ An unauthenticated user can execute a terminal command under the context of the web user. These vulnerabilities
17
+ are no longer present in the ASP.NET version CryptoLog, available since 2009.
17
18
18
- login.php endpoint is responsible for login process. One of the user supplied parameter is used by the application without input validation
19
- and parameter binding. Which cause a sql injection vulnerability. Successfully exploitation of this vulnerability gives us the valid session.
19
+ CryptoLog's login.php endpoint is responsible for the login process. One of the user supplied parameters is
20
+ used by the application without input validation and parameter binding, which leads to SQL injection
21
+ vulnerability. Successfully exploitating this vulnerability gives a the valid session.
20
22
21
- logshares_ajax.php endpoint is responsible for executing an operation system command. It's not possible to access this endpoint without having
22
- a valid session. One user parameter is used by the application while executing operating system command which cause a command injection issue.
23
+ CryptoLog's logshares_ajax.php endpoint is responsible for executing an operation system command. It's not
24
+ possible to access this endpoint without having a valid session. One user parameter is used by the
25
+ application while executing an operating system command, which causes a command injection issue.
23
26
24
- Combining these vulnerabilities gives us opportunity execute operation system command under the context of the web user.
27
+ Combining these vulnerabilities gives the opportunity execute operation system commands under the context
28
+ of the web user.
25
29
} ,
26
30
'License' => MSF_LICENSE ,
27
31
'Author' =>
0 commit comments