rapid7/metasploit-framework — pull request #1570 by whoisshop (2013-03-09 18:01:40+00:00)
Title: Altered php_eval to have SQL Char wrapper option and corrected exploit check

-Fixed the check() datastore[uri path].

-In rare cases, SQL data can be eval'd. In this case, a bool option to wrap the injection point in SQL char() has been appended.

*test.php?news=-1 UNION ALL SELECT 1,2,3--
*test.php?news=-1 UNION ALL SELECT 1,/*eval'd code/*,3--
*test.php?news=-1 UNION ALL SELECT 1,!CODE!,3--
*test.php?news=-1 UNION ALL SELECT 1,CHAR(41,41,...,41),3--

-tested and verified on live server