CVE-2018-1000533
CRITICAL NUCLEIGitList <= 0.6.0 - Remote Code Execution via Search Form Input
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2018-1000533.
PoCs published by Kacper Szurek, Shelby Pace, including Metasploit module exploits/multi/http/gitlist_arg_injection.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits an argument injection vulnerability in GitList v0.6.0 by bypassing PHP's 'escapeshellarg' function to achieve remote code execution (RCE). The exploit sends a crafted POST request with a malicious payload embedded in the 'query' parameter.
Description
klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. This attack appear to be exploitable via Send POST request using search form. This vulnerability appears to have been fixed in 0.7 after commit 87b8c26b023c3fc37f0796b14bb13710f397b322.
Exploits (1)
This Metasploit module exploits an argument injection vulnerability in GitList v0.6.0 by bypassing PHP's 'escapeshellarg' function to achieve remote code execution (RCE). The exploit sends a crafted POST request with a malicious payload embedded in the 'query' parameter.
Nuclei Templates (1)
cpe:"cpe:2.3:a:gitlist:gitlist"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H