CVE-2020-25042

This exploit demonstrates an authenticated remote code execution vulnerability in Mara CMS 7.5 by uploading a malicious PHP file via the file upload functionality. The vulnerability arises due to insufficient file extension validation, allowing an attacker to upload a webshell.

This Metasploit module exploits an arbitrary file upload vulnerability in MaraCMS 7.5 and prior to execute arbitrary commands. It authenticates, uploads a malicious PHP file, and triggers payload execution via HTTP requests.