phpStat 1.5 - 'setup.php' Authentication Bypass

ExploitDBExploitDB exploitExploitEDB-1016

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This is a Perl script that exploits an authentication bypass vulnerability in phpStat 1.5. It constructs a malicious HTTP GET request to setup.php with a 'check=yes' parameter and attacker-supplied credentials, which sets a new administrator password without requiring prior authentication. The script then instructs the user to log in with the new credentials.

Backdoor review

No backdoor observed in reviewed code

The provided Perl script is a straightforward proof-of-concept exploit for CVE-2005-1787. It sends a single HTTP GET request to the target's setup.php with a 'check=yes' parameter to bypass authentication and set a new admin password. The script contains no obfuscation, no secondary payloads, no attempts to connect to any host other than the specified target, and no code that would execute on the attacker's machine. The behavior is entirely consistent with the described exploit and shows no signs of backdoor functionality.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPerl
Target softwarephpStat 1.5
Attack typesAuthentication BypassPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a crafted HTTP request to the target server to change the administrator password without authentication, which is the definition of an exploit. It does not merely check for the vulnerability; it performs the unauthorized action.

exploits/php/webapps/1016.pl:5exploits/php/webapps/1016.pl:10exploits/php/webapps/1016.pl:46

Requirements

  • The target must be running phpStat 1.5 with the vulnerable setup.php file accessible.exploits/php/webapps/1016.pl:5
  • The attacker must provide the target host, the path to the phpStat installation, and a new password as command-line arguments.exploits/php/webapps/1016.pl:26exploits/php/webapps/1016.pl:31

Observed behavior

  • The script connects to the target web server on port 80.exploits/php/webapps/1016.pl:39-40
  • It sends a crafted HTTP GET request to the setup.php endpoint, including parameters 'check=yes', 'username=admin', and a user-supplied password.exploits/php/webapps/1016.pl:46
  • After sending the request, the script instructs the user to navigate to the setup.php page and log in with the username 'admin' and the password they provided.exploits/php/webapps/1016.pl:58-60
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
HTTP GET request to target's setup.php with parameters check=yes, username=admin, and user-supplied passwordThe script constructs and sends a single HTTP request to exploit the authentication bypass vulnerability in phpStat 1.5.exploits/php/webapps/1016.pl:46-48
Target Interaction
Connects only to the user-specified target host on port 80The script uses IO::Socket::INET to connect to the target provided as a command-line argument. No other network connections are made.exploits/php/webapps/1016.pl:39-40
User Interaction
Requires command-line arguments: target host, directory, and new passwordThe script prints usage instructions and exits if fewer than 3 arguments are provided.exploits/php/webapps/1016.pl:26-36
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the provided Perl script. The actual vulnerability in setup.php is not included, so the server-side mechanism of the bypass cannot be confirmed from this artifact alone.
  • The script's effectiveness depends on the target server's configuration and the exact vulnerable version of phpStat.
  • The review is limited to the supplied text of the exploit file. No external resources, dependencies, or the target application itself were analyzed.
  • The script's behavior on the target server (e.g., whether the password change is permanent or creates a backdoor account) is not assessed, as it is part of the intended exploit functionality.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1