CVE-2023-30258 — Magnus Billing v7 Command Injection (PoC)

Unauthenticated command injection vulnerability in Magnus Billing v7.3.0. The democ GET parameter in icepay.php is passed directly to a shell function without sanitization, allowing arbitrary command execution as the web server user. The injection is blind — output is not reflected in the HTTP response — so this exploit redirects each command's output to a file in the webroot and fetches it back over HTTP.

---

How it works

1. Sends a GET request to /mbilling/lib/icepay/icepay.php?democ=;<command>;.
2. Redirects the command output to a file inside the webroot (out.txt).
3. Fetches the output file over HTTP and prints the result.
4. Cleans up the output file on exit.

If the target uses a different webroot path, adjust OUTPUT_FILE at the top of the script.

Requirements