KrayinCRM-RCE-Exploit-CVE-2026-38526

CVE-2026-38526 exploit for Krayin CRM v2.2.x - Authenticated RCE via TinyMCE file upload bypass. Features interactive shell, multi-type payloads, auto shell generation, and verification. Author: Sudeepa Wanigarathna. For authorized testing only.

🚨 Vulnerability Details

The vulnerability stems from insufficient file type validation in the TinyMCE file upload endpoint (/admin/tinymce/upload). An authenticated administrator can:

• Upload a PHP file disguised with an image MIME type.
• The file is stored in a web-accessible location.
• The attacker can then execute arbitrary PHP code on the server.

Affected Versions

• Krayin CRM 2.2.0
• Krayin CRM 2.2.1
• Krayin CRM 2.2.2
• All 2.2.x versions before patch release

✨ Features

• Multiple Shell Types: Basic, Advanced, Minimal, File Manager, and Custom.
• Interactive Shell: Full terminal-like interface with command history.
• File Upload: Upload additional files through the shell.
• CSRF Token Extraction: Automatic handling of CSRF protection.
• Proxy Support: Route traffic through HTTP/HTTPS proxies.
• Flexible Output Formats: Text, JSON, or Silent mode.
• Retry Logic: Automatic retry on connection failures.
• Custom Headers: Support for custom HTTP headers.
• Verbose Mode: Detailed debugging output.
• SSL Support: Optional SSL certificate verification.

📦 Installation

Requirements

• bash
• Python 3.7+
• pip install httpx beautifulsoup4 colorama

Quick Install

Requirements File (requirements.txt)

🚀 Usage

Basic Command Syntax

Required Parameters

Common Usage Examples

🐚 Shell Types

1. Basic Shell (basic) Simple command execution with system() function.

   root@kitploit:~

   <?php if(isset($_REQUEST['cmd'])) { system($_REQUEST['cmd']); } ?>
   

2. Advanced Shell (advanced) Feature-rich shell with:

   • Multiple command execution methods
   • Beautiful terminal-like web interface
   • Command history support
   • Current user and hostname display

3. Minimal Shell (minimal) Minimal footprint for stealth.

   root@kitploit:~

   <?php system($_GET["cmd"]); ?>
   

4. File Manager (file_manager) Complete file management interface:

   • File upload
   • File deletion
   • Directory creation
   • Navigation
   • File permissions viewer

5. Custom Shell (custom) Use your own PHP shell file with the -f parameter.

📝 Output Formats

Text Format (Default)

Human-readable colored output suitable for interactive use.

JSON Format (-o json)

Machine-readable format for automation and integration.

Silent Format (-q, --quiet)

No output except for errors. Useful for batch processing.

⚙️ Advanced Options

Custom Headers Example

🔒 Detection & Prevention

Signs of Compromise (IoC)

• Files to Monitor:

  • Unusual PHP files in public/storage/upload/
  • Files with double extensions (e.g., image.php.jpg)
  • New files with suspicious names

• Logs to Check:

  • /admin/tinymce/upload POST requests
  • Unusual admin login times
  • Failed authentication attempts

• System Indicators:

  • Unexpected processes running
  • New cron jobs
  • Modified system files

Prevention Measures

• Immediate Actions:

  root@kitploit:~

  # Update to patched version
  composer update krayin/crm
  
  # Disable admin access temporarily
  # Remove unnecessary admin accounts
  # Change all admin passwords
  

• File Upload Hardening:

  root@kitploit:~

  // Validate file type by content, not just extension
  // Implement content security policy
  // Use Web Application Firewall (WAF)
  // Enable file upload scanning
  

• Access Control:

  root@kitploit:~

  # Restrict admin IPs in .htaccess
  # Implement MFA for admin accounts
  # Regular admin audit
  # Session timeout policies
  

• WAF Rules (ModSecurity):

  root@kitploit:~

  # Block suspicious file uploads
  SecRule FILES "\.(php|phtml|php[0-9])" "id:1001,deny,status:403,msg:'PHP file upload blocked'"
  
  # Block web shells
  SecRule ARGS "system|exec|shell_exec|passthru" "id:1002,deny,status:403,msg:'Shell command blocked'"
  

🛡️ Responsible Disclosure

This vulnerability was discovered through responsible security research. The disclosure process followed these steps:

• Discovery: Vulnerability identified during security assessment.
• Verification: Confirmed vulnerability in Krayin CRM 2.2.x.
• Report: Notified Krayin CRM developers privately.
• Coordination: Worked with the team to develop a fix.
• Patch: Awaiting official patch release.
• Disclosure: Public disclosure after patch availability.

Timeline

• Discovery: TBD
• Reported: TBD
• Patch Released: TBD
• Public Disclosure: TBD

📜 Disclaimer

🔧 Troubleshooting

Common Issues

• Issue: Authentication fails

  • Solution: Verify credentials, check if admin login path is /admin/login
  • Check: Ensure CSRF token extraction works correctly

• Issue: File upload fails

  • Solution: Check file permissions, verify upload endpoint exists
  • Check: Ensure target uses TinyMCE editor

• Issue: Shell doesn't execute commands

  • Solution: Verify PHP functions are not disabled in php.ini
  • Check: Test with simple command like echo test

• Issue: SSL certificate errors

  • Solution: Use --verify-ssl flag or disable verification
  • Note: Self-signed certificates will cause errors without proper verification

Debug Mode

🤝 Contributing

Contributions are welcome! Please ensure:

• All code is properly tested.
• Documentation is updated.
• Ethical guidelines are followed.
• Vulnerability research is conducted responsibly.

📚 References

• Krayin CRM Official Website
• CVE-2026-38526
• OWASP Remote Code Execution
• PHP Security Best Practices

⭐ Support

If you find this tool useful for security research, please consider:

• ⭐ Starring the repository
• 🔔 Following for updates
• 📢 Sharing with other security researchers

Created with ❤️ for Security Research

Remember: Great power comes with great responsibility. Use this knowledge wisely!

📊 Quick Command Reference Card

🔒 Remember: Always get written permission before testing any system!