CVE-2013-1744

published 2020-01-25

CVE-2013-1744: IRIS citations management tool through 1.3 allows remote attackers to execute arbitrary commands.

Priority P2 72 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

IRIS citations management tool through 1.3 allows remote attackers to execute arbitrary commands.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
iris_citations_management_tool_project	iris_citations_management_tool	<= 1.3	—

Detection & IOCs extracted from sources · hover to see the quote

path {$path}login.php↗

path {$path}phpwcms.php?do=articles&p=2&s=1&aktion=1&id=0↗

path {$path}index.php?aid={$_aid}↗

command {${error_reporting(0)}}{${print(aeon)}}{${passthru(base64_decode($_SERVER[HTTP_PHPWCMS]))}}{${die}}↗

other HTTP header: Phpwcms: <base64-encoded command>↗

• → Detect POST requests to login.php followed by POST to phpwcms.php?do=articles with a URL-encoded preg_replace payload in the article_summary field containing the pattern '{DATE:{...} lang=en}' ↗
• → Detect the string 'aeon' in HTTP responses from phpwcms index.php, which is the canary token printed by the injected PHP payload to confirm code execution ↗
• → Detect article_summary POST parameter values containing PHP code blocks using the {${ }} preg_replace /e modifier injection pattern targeting phpwcms template parsing ↗

• · The exploit targets phpwcms 1.5.4.6 specifically; the CVE description references IRIS citations management tool through 1.3 — the exploit-db source (Doc 2) is for a different product (phpwcms) and may not be the canonical exploit for CVE-2013-1744 ↗
• · The exploit requires valid admin credentials to authenticate before injecting the payload; unauthenticated exploitation is not demonstrated in this PoC ↗
• · Command execution is delivered via the HTTP_PHPWCMS server variable (custom Phpwcms: header), meaning WAF/proxy rules must inspect custom HTTP headers, not just POST body, to detect exploitation ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.