ashifcoder/cve-2026-22241Automated exploit for CVE-2026-22241, an unrestricted file upload vulnerability in Open eClass, enabling remote code execution via a webshell with automatic cleanup.
This exploit uses CVE-2026-22241 automates the login, ZIP creation, upload process and providing webshell directly on the server and removes it automatically once the exploit is completed.
An Unrestricted File Upload vulnerability in the Theme Import functionality of Open eClass (prior to version 4.2) allows an attacker with administrative privileges to achieve Remote Code Execution (RCE).
Vulnerability Details
Installation
git clone https://github.com/Ashifcoder/CVE-2026-22241.git
cd CVE-2026-22241/
pip install -r requirements.txt
Usage
python3 CVE-2026-22241.py -t http://127.0.0.1/openeclass -u admin -p adminpassword
Options Help
usage: CVE-2026-22241.py [-h] -t ECLASSURL -u USERNAME -p PASSWORD
Open eClass Unrestricted File Upload RCE Exploit [ CVE-2026-22241 ]
Example: CVE-2026-22241.py -t http://127.0.0.1/openeclass -u admin -p adminpassword
options:
-h, --help show this help message and exit
-t ECLASSURL, --eclassUrl ECLASSURL
Target URL of the Open eClass.
-u USERNAME, --username USERNAME
Admin Username for login.
-p PASSWORD, --password PASSWORD
Admin Password for login.
This script is for educational purposes and authorized security testing only. The author is not responsible for any damage caused by the misuse of this tool. Use responsibly and only on systems you have explicit permission to test.