CVE-2023-41892 PoC — Pixel＆tonic Craft CMS 代码注入漏洞

Source

https://github.com/0xfalafel/CraftCMS_CVE-2023-41892

Associated Vulnerability

Title:Pixel＆tonic Craft CMS 代码注入漏洞 (CVE-2023-41892)
Description:Pixel＆tonic Craft CMS是美国Pixel＆tonic公司的一套内容管理系统（CMS）。 Pixel＆tonic Craft CMS 4.4.15之前版本存在代码注入漏洞，该漏洞源于存在远程代码执行漏洞。

Description

Exploit for CVE-2023-41892

Readme

# Craft CMS CVE-2023-41892

There is a **Unauthenticated Remote Code Execution (RCE)** affecting **CraftCMS 4.0.0-RC1 - 4.4.14**.

![Usage of the exploit](./exploit.png)

## Usage

    python3 craft-cms.py http://target

## Requirements

The exploit make use of **`requests`**.
Install it with :

    python3 -m pip install requests

## Acknowledgements

https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g  
https://blog.calif.io/p/craftcms-rce  
https://gist.github.com/to016/b796ca3275fa11b5ab9594b1522f7226  
https://vulners.com/metasploit/MSF:EXPLOIT-LINUX-HTTP-CRAFTCMS_UNAUTH_RCE_CVE_2023_41892-  
https://threatprotect.qualys.com/2023/09/25/craft-cms-remote-code-execution-vulnerability-cve-2023-41892/

File Snapshot


 [4.0K]  /data/pocs/f3e925083a66db451d4ea107c42c80707f384be6
├── [4.2K]  craft-cms.py
├── [ 88K]  exploit.png
└── [ 731]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!