CVE-2026-27175 Exploit Metadata

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-10

Technical assessment

A Metasploit module that exploits an unauthenticated command injection vulnerability in MajorDoMo's rc/index.php. It injects a payload via the 'param' parameter, which is queued in the database and executed by the cycle_execs.php worker through a race condition.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented exploit for CVE-2026-27175. It sends HTTP requests to trigger a race condition and inject a user-supplied payload into a command queue. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed.

ClassificationExploit

Model confidence100%

AuthenticationNot required

Languagesruby

Target softwareMajorDoMo

Attack typescommand_injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The module's exploit method injects a payload via command substitution into the 'param' parameter, which is executed by the cycle_execs.php worker, achieving remote code execution. This is the primary purpose of the code.

modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:107-154

Requirements

Target must be running a vulnerable version of MajorDoMo with rc/index.php and cycle_execs.php accessible without authentication.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:19-28
A valid .bat file name (e.g., shutdown) must exist in rc/commands/.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:30-31

Observed behavior

Sends a GET request to rc/index.php with a command parameter to check vulnerability.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:84-88
Sends a GET request to cycle_execs.php to verify it is accessible without authentication.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:95-98
Bootstraps database tables by requesting cycle.php in a background thread.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:112-118
Starts the cycle_execs.php worker in a background thread to purge the queue and enter a polling loop.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:124-130
Injects the payload via the 'param' parameter in a GET request to rc/index.php, using command substitution syntax.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:137-144
Waits for the worker to poll the database and execute the injected command.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:150-151

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Injection: $(#{payload.encoded})The module injects the user-supplied Metasploit payload into the 'param' parameter, which is the core exploit mechanism.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:142
File Cleanup: register_file_for_cleanup('reboot')The module registers a 'reboot' file for cleanup, which is a standard Metasploit FileDropper mixin call to remove artifacts left by the exploit.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:147

Review boundaries

What the analysis did not establish

Analysis is based on module source and metadata only; framework mixins, libraries, and external payloads are not expanded.
The artifact is not executed; classification is based on static analysis of the provided Ruby code.
Review is limited to the module source code. Framework mixins, libraries, and external payloads referenced by the module (e.g., Msf::Exploit::Remote::HttpClient, payload.encoded) were not expanded or analyzed.
Binary files were not present in the evidence.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2026-27175