phpStat 1.5 - 'setup.php' Authentication Bypass (PHP) (2)

ExploitDBExploitDB exploitExploitEDB-1018

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

PHP script that sends a crafted HTTP GET request to setup.php to bypass authentication and set admin credentials by directly setting the $check variable via URL parameters.

Backdoor review

No backdoor observed in reviewed code

The provided PHP script is a proof-of-concept exploit for CVE-2005-1787 that demonstrates how to bypass authentication in phpStat 1.5 by sending a crafted HTTP GET request to setup.php. The script uses hardcoded credentials (admin/123456) and only interacts with the target host specified via command-line arguments. No backdoor, hidden payload, or unrelated malicious behavior is present in the reviewed text.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPHP
Target softwarephpStat 1.5
Attack typesauthentication_bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious HTTP request to the target to exploit an authentication bypass vulnerability and change admin credentials, which is the definition of an exploit.

exploits/php/webapps/1018.php:84exploits/php/webapps/1018.php:99

Requirements

  • Target must be running phpStat 1.5 with a vulnerable setup.php that accepts username and password parameters when $check is set.exploits/php/webapps/1018.php:84

Observed behavior

  • Script constructs an HTTP GET request to the target's setup.php with parameters check=yes, username, and password to bypass authentication and set new admin credentials.exploits/php/webapps/1018.php:84
  • Script checks the response for the string 'Setup has been updated' to confirm successful exploitation.exploits/php/webapps/1018.php:99
  • Script outputs the target URL and the new admin credentials (username: admin, password: 123456) upon success.exploits/php/webapps/1018.php:102
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Credentials
username=admin, password=123456The script sets these credentials and sends them to the target setup.php to change the admin account. This is the documented exploit behavior, not a backdoor.exploits/php/webapps/1018.php:49-50exploits/php/webapps/1018.php:84
Network Connection
fsockopen to target host on port 80The script connects to the user-supplied target to deliver the exploit payload. This is the intended exploit functionality.exploits/php/webapps/1018.php:77
Command Line Arguments
Requires target host and path to setup.phpThe script takes two command-line arguments: the target host and the path to setup.php. It validates that the second argument contains 'setup.php'.exploits/php/webapps/1018.php:60-71
Review boundaries

What the analysis did not establish

  • Only the exploit script text was reviewed; external resources (e.g., the advisory URL) were not fetched or analyzed.
  • The script's behavior depends on the target server's response; no server-side code was reviewed.
  • Binary files were flagged as metadata-only and not inspected, but none were present in this artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1