GitList <= 0.6.0 - Remote Code Execution via Search Form Input
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2018-1000533.
PoCs published by dddo0, Kacper Szurek, Shelby Pace, including Metasploit module exploits/multi/http/gitlist_arg_injection.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2018-1000533, a remote code execution vulnerability in GitList 0.6.0. The exploit leverages improper input validation in the `git grep` command via the `--open-files-in-pager` option to execute arbitrary system commands.
Description
klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. This attack appear to be exploitable via Send POST request using search form. This vulnerability appears to have been fixed in 0.7 after commit 87b8c26b023c3fc37f0796b14bb13710f397b322.
Exploits (2)
This repository contains a functional PoC for CVE-2018-1000533, a remote code execution vulnerability in GitList 0.6.0. The exploit leverages improper input validation in the `git grep` command via the `--open-files-in-pager` option to execute arbitrary system commands.
This Metasploit module exploits an argument injection vulnerability in GitList v0.6.0 by bypassing PHP's 'escapeshellarg' function to achieve remote code execution (RCE). The exploit sends a crafted POST request with a malicious payload embedded in the 'query' parameter.
Nuclei Templates (1)
cpe:"cpe:2.3:a:gitlist:gitlist"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H