Exploitation Summary
EIP tracks 3 public exploits for CVE-2014-1683.
PoCs published by Metasploit, Scott Parish, including Metasploit module exploits/unix/webapp/skybluecanvas_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in SkyBlueCanvas CMS by injecting a payload into the 'name' parameter of a POST request. The exploit targets versions 1.1 r248-03 and below, achieving remote code execution.
Description
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
Exploits (3)
This Metasploit module exploits a command injection vulnerability in SkyBlueCanvas CMS by injecting a payload into the 'name' parameter of a POST request. The exploit targets versions 1.1 r248-03 and below, achieving remote code execution.
This exploit demonstrates a remote command injection vulnerability in SkyBlueCanvas CMS 1.1 r248-03. The PoC uses a crafted HTML form to inject a reverse shell payload via the 'name' parameter, exploiting unsanitized POST parameters in the contact form.
This Metasploit module exploits a command injection vulnerability in SkyBlueCanvas CMS by injecting a payload into the 'name' parameter of a POST request. The exploit targets versions 1.1 r248-03 and below, achieving remote code execution.