File tree Expand file tree Collapse file tree 1 file changed +23
-3
lines changed
modules/exploits/multi/http Expand file tree Collapse file tree 1 file changed +23
-3
lines changed Original file line number Diff line number Diff line change @@ -16,8 +16,10 @@ def initialize(info = {})
16
16
super ( update_info ( info ,
17
17
'Name' => 'phpMyAdmin Authenticated Remote Code Execution via preg_replace()' ,
18
18
'Description' => %q{
19
- This module exploits a PREG_REPLACE EVAL vulnerability in phpMyAdmin's
20
- replace_prefix_tbl in libraries/mult_submits.inc.php via db_settings.php
19
+ This module exploits a PREG_REPLACE_EVAL vulnerability in phpMyAdmin's
20
+ replace_prefix_tbl within libraries/mult_submits.inc.php via db_settings.php
21
+ This affects versions 3.5.x < 3.5.8.1 and 4.0.0 < 4.0.0-rc3.
22
+ PHP versions > 5.4.6 are not vulnerable.
21
23
} ,
22
24
'Author' =>
23
25
[
@@ -75,8 +77,26 @@ def check
75
77
return CheckCode ::Unknown
76
78
end
77
79
80
+ php_version = res [ 'X-Powered-By' ]
81
+ if php_version
82
+ print_status ( "PHP Version: #{ php_version } " )
83
+ if php_version =~ /PHP\/ (\d )\. (\d )\. (\d )/
84
+ if $1. to_i > 5
85
+ return CheckCode ::Safe
86
+ else
87
+ if $1. to_i == 5 and $2. to_i > 4
88
+ return CheckCode ::Safe
89
+ else
90
+ if $1. to_i == 5 and $2. to_i == 4 and $3. to_i > 6
91
+ return CheckCode ::Safe
92
+ end
93
+ end
94
+ end
95
+ end
96
+ end
97
+
78
98
if res . body =~ /pmaversion = '(.*)';/
79
- print_status ( "Server version: #{ $1} " )
99
+ print_status ( "phpMyAdmin version: #{ $1} " )
80
100
case $1. downcase
81
101
when '3.5.8.1' , '4.0.0-rc3'
82
102
return CheckCode ::Safe
You can’t perform that action at this time.
0 commit comments