CVE-2024-9441 PoC — Linear eMerge e3-Series Forgot Password Command Injection

Source

Associated Vulnerability

Readme

# CVE-2024-9441
Description of the Vulnerability:

This code exploits a Remote Code Execution (RCE) vulnerability that occurs due to improper input sanitization in a PHP-based web application. The specific weakness is in the "forgot password" functionality (index.php?c=user&m=forgot_password), where user input is not properly sanitized, allowing attackers to inject arbitrary PHP code into the server.

This script exploits a vulnerability in a PHP-based application to upload a malicious PHP script to the server and execute system commands via HTTP requests.
Steps to Use:


python exploit.py "/bin/ls -al /var/www/html"

If the exploit succeeds, you should see the directory contents in the terminal output.

File Snapshot

 [4.0K]  /data/pocs/6996d5c1a19191f867f66c001c0f5943721aa43b
├── [1.4K]  Poc-CVE-2024-9441.py
└── [ 713]  README.md

0 directories, 2 files

Remarks