CVE-2020-28871

This exploit targets Monitorr 1.7.6m by uploading a malicious PHP file via an unauthenticated file upload vulnerability, then triggering it to execute a reverse shell. The payload uses a GIF magic number to bypass basic file type checks.

This Metasploit module exploits an arbitrary file upload vulnerability in Monitorr (CVE-2020-28871) to achieve unauthenticated remote code execution. It uploads a malicious PHP webshell disguised as a GIF file and executes commands via HTTP requests.