CVE-2013-1412
DataLife Engine 9.7 - Remote Code Execution via catlist[] Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2013-1412.
PoCs published by Metasploit, EgiX, EgiX, juan vazquez, including Metasploit module exploits/unix/webapp/datalife_preview_exec.
AI-analyzed exploit summary This Metasploit module exploits a PHP code injection vulnerability in DataLife Engine 9.7 via insecure usage of preg_replace() with the e modifier in preview.php. It injects arbitrary PHP code when the template contains a [catlist] or [not-catlist] tag.
Description
DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.
Exploits (3)
This Metasploit module exploits a PHP code injection vulnerability in DataLife Engine 9.7 via insecure usage of preg_replace() with the e modifier in preview.php. It injects arbitrary PHP code when the template contains a [catlist] or [not-catlist] tag.
The writeup describes a PHP code injection vulnerability in DataLife Engine 9.7 due to improper sanitization of the 'catlist' parameter in the /engine/preview.php script, allowing arbitrary PHP code execution via preg_replace with the e modifier.
This Metasploit module exploits a PHP code injection vulnerability in DataLife Engine 9.7 via insecure usage of preg_replace() with the e modifier in preview.php. It allows arbitrary PHP code execution when a template with [catlist] or [not-catlist] tags is present.