Skip to content

Commit e25fdeb

Browse files
committed
Add php version to check
1 parent cd842df commit e25fdeb

File tree

1 file changed

+23
-3
lines changed

1 file changed

+23
-3
lines changed

modules/exploits/multi/http/phpmyadmin_preg_replace.rb

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,10 @@ def initialize(info = {})
1616
super(update_info(info,
1717
'Name' => 'phpMyAdmin Authenticated Remote Code Execution via preg_replace()',
1818
'Description' => %q{
19-
This module exploits a PREG_REPLACE EVAL vulnerability in phpMyAdmin's
20-
replace_prefix_tbl in libraries/mult_submits.inc.php via db_settings.php
19+
This module exploits a PREG_REPLACE_EVAL vulnerability in phpMyAdmin's
20+
replace_prefix_tbl within libraries/mult_submits.inc.php via db_settings.php
21+
This affects versions 3.5.x < 3.5.8.1 and 4.0.0 < 4.0.0-rc3.
22+
PHP versions > 5.4.6 are not vulnerable.
2123
},
2224
'Author' =>
2325
[
@@ -75,8 +77,26 @@ def check
7577
return CheckCode::Unknown
7678
end
7779

80+
php_version = res['X-Powered-By']
81+
if php_version
82+
print_status("PHP Version: #{php_version}")
83+
if php_version =~ /PHP\/(\d)\.(\d)\.(\d)/
84+
if $1.to_i > 5
85+
return CheckCode::Safe
86+
else
87+
if $1.to_i == 5 and $2.to_i > 4
88+
return CheckCode::Safe
89+
else
90+
if $1.to_i == 5 and $2.to_i == 4 and $3.to_i > 6
91+
return CheckCode::Safe
92+
end
93+
end
94+
end
95+
end
96+
end
97+
7898
if res.body =~ /pmaversion = '(.*)';/
79-
print_status("Server version: #{$1}")
99+
print_status("phpMyAdmin version: #{$1}")
80100
case $1.downcase
81101
when '3.5.8.1', '4.0.0-rc3'
82102
return CheckCode::Safe

0 commit comments

Comments
 (0)