CVE-2014-4511
Gitlist < 0.5.0 - Remote Code Execution via Shell Metacharacters in URI
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2014-4511.
PoCs published by Metasploit, drone, michaelsss1, including Metasploit module exploits/linux/http/gitlist_exec.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated remote command execution vulnerability in Gitlist 0.4.0 by injecting commands into a specially crafted filename during a blame operation.
Description
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.
Exploits (4)
This Metasploit module exploits an unauthenticated remote command execution vulnerability in Gitlist 0.4.0 by injecting commands into a specially crafted filename during a blame operation.
This exploit leverages a command injection vulnerability in Gitlist <= 0.4.0 by crafting a malicious URL path that executes arbitrary commands via the `blame` functionality. The payload is base64-encoded and written to a PHP file in the cache directory, enabling remote code execution.
This repository provides a proof-of-concept for CVE-2014-4511, a remote code execution vulnerability in GitList. The exploit involves uploading a malicious PHP file to the target server and executing arbitrary commands via a reverse shell.
This Metasploit module exploits an unauthenticated remote command execution vulnerability in Gitlist 0.4.0 by injecting commands into a crafted file name during a blame operation. It includes a check method to verify vulnerability and an exploit method to execute the payload.