Description
The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" in the char_repl parameter, which is inserted into a regular expression that is processed by the preg_replace function with the eval switch.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
vBSEO proc_deutf() Remote PHP Code Injection
exploit/multi/http/vbseo_proc_deutf
Exploit-DB 1
- vBSEO 3.6.0 - 'proc_deutf()' Remote PHP Code Injection (Metasploit) EDB-18424 · webapps · Jan 27, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 18424 exploit
- vbseo-procdeutf-code-execution(72689) vdb-entry
- 51647 vdb-entry
- 47699 third-party-advisory
- 78508 vdb-entry
- http://www.vbseo.com/f5/vbseo-security-bulletin-all-supported-versions-patch-release-52783/