CVE-2023-4596 PoC — Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

Description

CVE-2023-4596 Vulnerable Exploit and Checker Version

Readme

# CVE-2023-4596

[![made-with-Python](https://img.shields.io/badge/made%20with-Python-blue.svg)](https://www.python.org/)
[![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
[![issues](https://img.shields.io/github/issues/X-Projetion/searchsan?color=blue)](https://github.com/X-Projetion/CVE-2023-4596-Vulnerable-Exploit-and-Checker-Version/issues)

<p align="center">
  <img src="banner.png" alt="CVE-2023-4596 Vulnerable Exploit and Checker Version" width="60%">
</p>

PoC Script for CVE-2023-4596, An efficient Python tool created to perform unauthenticated Remote Command Execution via arbitrary file uploads.

---

## Resources

- [Installation](#installation)
- [Usage](#usage)
- [Usage](#Disclaimer)

## Installation

```bash
git clone https://github.com/X-Projetion/CVE-2023-4596-Vulnerable-Exploit-and-Checker-Version && cd CVE-2023-4596-Vulnerable-Exploit-and-Checker-Version
pip install -r requirements.txt
```

## Usage
```text
python exp.py -h
```
This will display all the options that can be used.
```text
   _______    ________    ___   ____ ___  _____       __ __  __________  _____
  / ____/ |  / / ____/   |__ \ / __ \__ \|__  /      / // / / ____/ __ \/ ___/
 / /    | | / / __/________/ // / / /_/ / /_ <______/ // /_/___ \/ /_/ / __ \
/ /___  | |/ / /__/_____/ __// /_/ / __/___/ /_____/__  __/___/ /\__, / /_/ /
\____/  |___/_____/    /____/\____/____/____/        /_/ /_____//____/\____/
                                https://github.com/X-Projetion/

usage: exp.py [-h] -f F [-v] [-r]

Script to check for CVE-2023-4596

options:
  -h, --help  show this help message and exit
  -f F        File containing URLs to check
  -v          Check for a (vulnerable) version
  -r          Get a reverse shell on the instance
```

# Known errors
**[-] Could not extract forminator_nonce** <br>
This exploit only works when a link is provided of the exact page where the file upload is enabled with Forminator. When a link is provided with just the domain or a page that is not running a file upload on it, it spits out an error. This is because it exports the forminator_nonce from the provided URL and if this page is not running Forminator or the Forminator file upload, it can't find the value and can't use it. You can also check by finding the string "forminator-field-post-image-postdata" in the source code of the site. A full link, for example, looks like this: `http://localhost:1337/?p=7`.


## Disclaimer
The script provided is for educational purposes only, I am not responsible for your actions.

<br>

[instagram](https://www.instagram.com/lutfifakee/) <br>
Made by X-Projetion

File Snapshot

Remarks