p33d/cve-2024-9441Exploit for CVE-2024-9441: Remote Code Execution via improper input sanitization in PHP forgot-password functionality. Uploads a malicious script and executes system commands.
Description of the Vulnerability:
This code exploits a Remote Code Execution (RCE) vulnerability that occurs due to improper input sanitization in a PHP-based web application. The specific weakness is in the "forgot password" functionality (index.php?c=user&m=forgot_password), where user input is not properly sanitized, allowing attackers to inject arbitrary PHP code into the server.
This script exploits a vulnerability in a PHP-based application to upload a malicious PHP script to the server and execute system commands via HTTP requests. Steps to Use:
python exploit.py "/bin/ls -al /var/www/html"
If the exploit succeeds, you should see the directory contents in the terminal output.
