hereticl1nk/eits-portal-exploit-cve-2026-31367-pocPoC exploit for unauthenticated RCE in EITS Admin Dashboard v2.4.0 via command injection in /api/v1/debug, allowing arbitrary OS command execution on exposed servers.
This repository contains the Proof of Concept (PoC) for the unauthenticated Remote Code Execution (RCE) vulnerability in [EITS Admin Dashboard] v2.4.0 (CVE-2026-31367).
The vulnerability occurs due to a flaw in input sanitization on the /api/v1/debug endpoint, allowing an attacker to inject and execute arbitrary commands on the server through an obfuscated payload.
This script was created strictly for educational and research purposes. The use of this tool to attack targets without prior mutual consent is illegal. The author assumes no responsibility and is not liable for any misuse or damage caused by this program.
Clone the repository and run the script passing the target as a parameter:
git clone [https://github.com/](https://github.com/hereticL1nk)[hereticL1nk]/cve-2026-31367-poc.git
cd cve-2026-31337-poc
python3 exploit.py -t [http://10.10.10.42](http://10.10.10.42)