Exploitation Summary
EIP tracks 4 public exploits for CVE-2022-26265. PoCs published by sh4den, SystemVll, redteamsecurity2023.
AI-analyzed exploit summary This exploit targets CVE-2022-26265, a remote code execution vulnerability in Contao CMS v1.5.0. The PoC sends a crafted HTTP POST request to the `/api/server/config` endpoint with a malicious `php_cli` parameter, allowing arbitrary command execution via a hardcoded admin JWT token in the `contao_manager_auth` cookie.
Description
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
Exploits (4)
This exploit targets CVE-2022-26265, a remote code execution vulnerability in Contao CMS v1.5.0. The PoC sends a crafted HTTP POST request to the `/api/server/config` endpoint with a malicious `php_cli` parameter, allowing arbitrary command execution via a hardcoded admin JWT token in the `contao_manager_auth` cookie.
This repository contains a Python-based exploit for CVE-2022-26265, targeting Contao CMS v1.5.0. The exploit sends a crafted POST request to the `/api/server/config` endpoint with a malicious `php_cli` parameter to achieve remote code execution (RCE).
This PoC exploits CVE-2022-26265, an RCE vulnerability in Contao CMS v1.5.0, by sending a crafted POST request to the `/api/server/config` endpoint with a malicious `php_cli` parameter. The exploit uses a hardcoded JWT token for authentication and supports multi-threaded execution against a list of targets.
This repository contains a functional exploit for CVE-2022-26265, targeting Contao CMS v1.5.0. The exploit sends a crafted POST request to the `/api/server/config` endpoint with a malicious `php_cli` parameter to achieve remote code execution (RCE).
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H