CVE-2020-35729

This Metasploit module exploits an unauthenticated command injection vulnerability in Klog Server <= 2.4.1 via the 'user' parameter, which is passed to shell_exec() without validation. It includes a check for vulnerability and executes a command stager for payload delivery.

This exploit demonstrates an unauthenticated command injection vulnerability in Klog Server 2.4.1 by injecting a reverse shell payload into the 'user' parameter of a POST request to the authentication endpoint.

This repository contains a functional Python exploit for CVE-2020-35729, an unauthenticated command injection vulnerability in Klog Server 2.4.1. The exploit sends a crafted payload via HTTP POST to the authenticate.php endpoint, achieving remote code execution.

This Metasploit module exploits an unauthenticated command injection vulnerability in Klog Server's `authenticate.php` via the `user` POST parameter, leveraging `shell_exec()` without input validation. It achieves RCE as the apache user and escalates to root via sudo misconfiguration.