CVE-2005-1787

phpStat 1.5 - 'setup.php' Authentication Bypass

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2005-1787 has a selected CVSS score of 7.5; EIP currently links 3 catalogued exploits.

Description

setup.php in phpStat 1.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the $check variable.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
3

Proofs of concept

3

Catalogued exploits

ExploitDBphpStat 1.5 - 'setup.php' Authentication BypassExploitDB exploitby Alpha_ProgrammerExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This is a Perl script that exploits an authentication bypass vulnerability in phpStat 1.5. It constructs a malicious HTTP GET request to setup.php with a 'check=yes' parameter and attacker-supplied credentials, which sets a new administrator password without requiring prior authentication. The script then instructs the user to log in with the new credentials.

Backdoor review

No backdoor observed in reviewed code

The provided Perl script is a straightforward proof-of-concept exploit for CVE-2005-1787. It sends a single HTTP GET request to the target's setup.php with a 'check=yes' parameter to bypass authentication and set a new admin password. The script contains no obfuscation, no secondary payloads, no attempts to connect to any host other than the specified target, and no code that would execute on the attacker's machine. The behavior is entirely consistent with the described exploit and shows no signs of backdoor functionality.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPerl
Target softwarephpStat 1.5
Attack typesAuthentication BypassPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a crafted HTTP request to the target server to change the administrator password without authentication, which is the definition of an exploit. It does not merely check for the vulnerability; it performs the unauthorized action.

exploits/php/webapps/1016.pl:5exploits/php/webapps/1016.pl:10exploits/php/webapps/1016.pl:46

Requirements

  • The target must be running phpStat 1.5 with the vulnerable setup.php file accessible.exploits/php/webapps/1016.pl:5
  • The attacker must provide the target host, the path to the phpStat installation, and a new password as command-line arguments.exploits/php/webapps/1016.pl:26exploits/php/webapps/1016.pl:31

Observed behavior

  • The script connects to the target web server on port 80.exploits/php/webapps/1016.pl:39-40
  • It sends a crafted HTTP GET request to the setup.php endpoint, including parameters 'check=yes', 'username=admin', and a user-supplied password.exploits/php/webapps/1016.pl:46
  • After sending the request, the script instructs the user to navigate to the setup.php page and log in with the username 'admin' and the password they provided.exploits/php/webapps/1016.pl:58-60
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Payload withheldThe script constructs and sends a single HTTP request to exploit the authentication bypass vulnerability in phpStat 1.5.exploits/php/webapps/1016.pl:46-48
Target Interaction
Payload withheldThe script uses IO::Socket::INET to connect to the target provided as a command-line argument. No other network connections are made.exploits/php/webapps/1016.pl:39-40
User Interaction
Payload withheldThe script prints usage instructions and exits if fewer than 3 arguments are provided.exploits/php/webapps/1016.pl:26-36
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the provided Perl script. The actual vulnerability in setup.php is not included, so the server-side mechanism of the bypass cannot be confirmed from this artifact alone.
  • The script's effectiveness depends on the target server's configuration and the exact vulnerable version of phpStat.
  • The review is limited to the supplied text of the exploit file. No external resources, dependencies, or the target application itself were analyzed.
  • The script's behavior on the target server (e.g., whether the password change is permanent or creates a backdoor account) is not assessed, as it is part of the intended exploit functionality.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

ExploitDBphpStat 1.5 - 'setup.php' Authentication Bypass (PHP) (1)ExploitDB exploitby mh_p0rtalScanner1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a PHP script that generates an HTML form pre-filled with the parameters 'check=yes', 'username=admin', and 'password=abc123', and submits them to a user-specified setup.php URL. It does not contain any code to automatically send the request or process a response; it only provides a manual interface for testing the authentication bypass.

Backdoor review

No backdoor observed in reviewed code

The PoC is a simple HTML form generator that submits authentication bypass parameters to a target setup.php. It contains no concealed executable behavior, no obfuscation, no persistence mechanisms, and no unrelated payloads. All actions are limited to the stated exploit behavior.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagesphp
Target softwarephpStat
Attack typesauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only generates an HTML form for manual submission; it does not automatically send an HTTP request, parse a response, or perform any action that constitutes exploitation. This is consistent with a scanner or validation tool that checks for the vulnerability by allowing a user to manually test the bypass.

exploits/php/webapps/1017.php:22-27

Requirements

  • The target must be running phpStat 1.5 with a vulnerable setup.php endpoint.exploits/php/webapps/1017.php:1
  • The user must manually set the $url variable to the target's setup.php location.exploits/php/webapps/1017.php:18

Observed behavior

  • The script outputs an HTML form with hidden and text input fields for 'check', 'username', and 'password'.exploits/php/webapps/1017.php:22-27
  • The form action is set to the user-configured $url with query parameters 'check=yes&username=$username&password=$password'.exploits/php/webapps/1017.php:22
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Form Action
Payload withheldThe form submits the 'check=yes' parameter to the target, consistent with the described authentication bypass for CVE-2005-1787.exploits/php/webapps/1017.php:22
Form Fields
Payload withheldThe form provides user-editable fields for username and password, and a hidden field to set the 'check' parameter, which is the documented bypass mechanism.exploits/php/webapps/1017.php:23-25
Target Url
Payload withheldThe target URL is a placeholder; no hardcoded malicious domain is present.exploits/php/webapps/1017.php:18
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the provided PHP source code; no network traffic or runtime behavior was observed.
  • The script's description labels it as a 'POC Exploit', but the code itself only provides a manual testing interface.
  • Only the supplied text file was reviewed; no binary files were present.
  • The artifact is a client-side PoC; server-side behavior of the target application is not evaluated.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

ExploitDBphpStat 1.5 - 'setup.php' Authentication Bypass (PHP) (2)ExploitDB exploitby Nikyt0xExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

PHP script that sends a crafted HTTP GET request to setup.php to bypass authentication and set admin credentials by directly setting the $check variable via URL parameters.

Backdoor review

No backdoor observed in reviewed code

The provided PHP script is a proof-of-concept exploit for CVE-2005-1787 that demonstrates how to bypass authentication in phpStat 1.5 by sending a crafted HTTP GET request to setup.php. The script uses hardcoded credentials (admin/123456) and only interacts with the target host specified via command-line arguments. No backdoor, hidden payload, or unrelated malicious behavior is present in the reviewed text.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPHP
Target softwarephpStat 1.5
Attack typesauthentication_bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious HTTP request to the target to exploit an authentication bypass vulnerability and change admin credentials, which is the definition of an exploit.

exploits/php/webapps/1018.php:84exploits/php/webapps/1018.php:99

Requirements

  • Target must be running phpStat 1.5 with a vulnerable setup.php that accepts username and password parameters when $check is set.exploits/php/webapps/1018.php:84

Observed behavior

  • Script constructs an HTTP GET request to the target's setup.php with parameters check=yes, username, and password to bypass authentication and set new admin credentials.exploits/php/webapps/1018.php:84
  • Script checks the response for the string 'Setup has been updated' to confirm successful exploitation.exploits/php/webapps/1018.php:99
  • Script outputs the target URL and the new admin credentials (username: admin, password: 123456) upon success.exploits/php/webapps/1018.php:102
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Credentials
Payload withheldThe script sets these credentials and sends them to the target setup.php to change the admin account. This is the documented exploit behavior, not a backdoor.exploits/php/webapps/1018.php:49-50exploits/php/webapps/1018.php:84
Network Connection
Payload withheldThe script connects to the user-supplied target to deliver the exploit payload. This is the intended exploit functionality.exploits/php/webapps/1018.php:77
Command Line Arguments
Payload withheldThe script takes two command-line arguments: the target host and the path to setup.php. It validates that the second argument contains 'setup.php'.exploits/php/webapps/1018.php:60-71
Review boundaries

What the analysis did not establish

  • Only the exploit script text was reviewed; external resources (e.g., the advisory URL) were not fetched or analyzed.
  • The script's behavior depends on the target server's response; no server-side code was reviewed.
  • Binary files were flagged as metadata-only and not inspected, but none were present in this artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

6