CVE-2021-44967 PoC — LimeSurvey 代码问题漏洞

Description

Authenticated (privileged) remote command execution in LimeSurvey Version 5.2.4 via upload and install plugins allows a remote user to upload arbitrary PHP code file.

介绍

# CVE-2021-44967 - Authenticated(privileged) RCE
Authenticated (privileged) remote command execution in LimeSurvey Version 5.2.4 via upload and install plugins allows a remote user to upload arbitrary PHP code file.


# Usage
`python3 exploit.py --url <http://example.com> --user <userName> --password <userPassword> --lhost <localHost> --lport <localPort>`

A superadmin user is allowed to load plugin modules through the LimeSurvey administration panel. The script locally creates the files, zips and uploads them. Later, a call is made to install, activate and run the modules, executing the reverse shell.




![image](https://github.com/user-attachments/assets/e28b12b1-e3db-43a3-9dfc-8429e6c79e88)

文件快照

备注