Vulnerability & Exploit Database

Back to search

X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution

This module exploits a post-auth vulnerability found in X7 Chat versions 2.0.0 up to 2.0.5.1. The vulnerable code exists on lib/message.php, which uses preg_replace() function with the /e modifier. This allows a remote authenticated attacker to execute arbitrary PHP code in the remote machine.

Free Metasploit Download

Get your copy of the world's leading penetration testing tool

 Download Now

Module Name

exploit/multi/http/x7chat2_php_exec

Authors

  • Fernando Munoz <fernando [at] null-life.com>
  • Juan Escobar <eng.jescobar [at] gmail.com>

References

Targets

  • Generic (PHP Payload)

Platforms

  • php

Architectures

  • php

Reliability

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/multi/http/x7chat2_php_exec msf exploit(x7chat2_php_exec) > show targets ...targets... msf exploit(x7chat2_php_exec) > set TARGET <target-id> msf exploit(x7chat2_php_exec) > show options ...show and set options... msf exploit(x7chat2_php_exec) > exploit