Bludit CMS 3.18.4 - RCE

ExploitDBExploitDB exploitExploitEDB-52553

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-25099 in Bludit CMS < 3.18.4 by uploading a PHP webshell via the unrestricted /api/files/<page-key> endpoint using a valid API token, then executing arbitrary commands on the target.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that exploits CVE-2026-25099 by uploading a PHP webshell to a vulnerable Bludit instance and then executing commands through it. All code is plain text, well-commented, and directly implements the described exploit steps: retrieving a page key, uploading a webshell, verifying RCE, and providing an interactive shell. No obfuscation, concealed payloads, persistence mechanisms, credential exfiltration, or unrelated remote access are present.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwareBludit CMS
Attack typesremote code executionunrestricted file upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by uploading a PHP webshell and executing arbitrary commands, which is the definition of an exploit.

exploits/multiple/webapps/52553.py:50-69exploits/multiple/webapps/52553.py:72-80

Requirements

  • Valid Bludit API tokenexploits/multiple/webapps/52553.py:88
  • Target running Bludit CMS version < 3.18.4 with API plugin enabledexploits/multiple/webapps/52553.py:6

Observed behavior

  • Retrieves a page key from /api/pages using the provided tokenexploits/multiple/webapps/52553.py:33-47
  • Uploads a PHP file containing a command execution webshell to /api/files/<page-key>exploits/multiple/webapps/52553.py:50-69
  • Executes arbitrary system commands via the uploaded webshellexploits/multiple/webapps/52553.py:72-80
  • Provides an interactive shell for continuous command executionexploits/multiple/webapps/52553.py:124-138
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Upload
<?php if(isset($_REQUEST["cmd"])){echo "<pre>";system($_REQUEST["cmd"]);echo "</pre>";} ?>The script uploads a minimal PHP webshell to the target server as part of the documented exploit. This is the expected behavior for an RCE PoC targeting an unrestricted file upload vulnerability.exploits/multiple/webapps/52553.py:53
Command Execution
system($_REQUEST["cmd"])The uploaded webshell executes arbitrary commands via PHP's system() function. This is the core of the RCE demonstration and is consistent with the stated exploit goal.exploits/multiple/webapps/52553.py:53
Interactive Shell
while True: cmd = input("shell> ") ... execute_command(shell_url, cmd)The script provides an interactive command loop that sends user-supplied commands to the uploaded webshell. This is a standard feature of RCE PoCs and does not indicate hidden backdoor behavior.exploits/multiple/webapps/52553.py:125-138
Review boundaries

What the analysis did not establish

  • Only the supplied text file (52553.py) was reviewed; no external dependencies, libraries, or referenced resources were inspected.
  • The review does not assess whether the exploit works as claimed or whether the target vulnerability is correctly identified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1