CVE-2021-44967 PoC — LimeSurvey 代码问题漏洞

Source

https://github.com/monke443/CVE-2021-44967

Associated Vulnerability

Title:LimeSurvey 代码问题漏洞 (CVE-2021-44967)
Description:LimeSurvey（前称PHPSurveyor）是LimeSurvey（Limesurvey）团队的一套开源的在线问卷调查程序，它支持调查程序开发、调查问卷发布以及数据收集等功能。 LimeSurvey 5.2.4 存在安全漏洞，该漏洞允许远程恶意用户上传任意PHP代码文件。

Description

Authenticated (privileged) remote command execution in LimeSurvey Version 5.2.4 via upload and install plugins allows a remote user to upload arbitrary PHP code file.

Readme

# CVE-2021-44967 - Authenticated(privileged) RCE
Authenticated (privileged) remote command execution in LimeSurvey Version 5.2.4 via upload and install plugins allows a remote user to upload arbitrary PHP code file.


# Usage
`python3 exploit.py --url <http://example.com> --user <userName> --password <userPassword> --lhost <localHost> --lport <localPort>`

A superadmin user is allowed to load plugin modules through the LimeSurvey administration panel. The script locally creates the files, zips and uploads them. Later, a call is made to install, activate and run the modules, executing the reverse shell.




![image](https://github.com/user-attachments/assets/e28b12b1-e3db-43a3-9dfc-8429e6c79e88)

File Snapshot


 [4.0K]  /data/pocs/79e583301e4ecd0e5b18950e6ebc15ae3c06f0b8
├── [7.4K]  exploit.py
└── [ 704]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!