Exploitation Summary
EIP tracks 2 public exploits for CVE-2013-7387. PoCs published by Metasploit, EgiX.
AI-analyzed exploit summary This Metasploit module exploits a PHP code injection vulnerability in DataLife Engine 9.7 via insecure usage of preg_replace() with the e modifier in preview.php. It injects arbitrary PHP code when the template contains a [catlist] or [not-catlist] tag.
Description
Session fixation vulnerability in DataLife Engine (DLE) 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie.
Exploits (2)
This Metasploit module exploits a PHP code injection vulnerability in DataLife Engine 9.7 via insecure usage of preg_replace() with the e modifier in preview.php. It injects arbitrary PHP code when the template contains a [catlist] or [not-catlist] tag.
The writeup describes a PHP code injection vulnerability in DataLife Engine 9.7 due to improper sanitization of the 'catlist' parameter in the /engine/preview.php script, allowing arbitrary PHP code execution via preg_replace with the e modifier.