CVE-2024-35540

This exploit leverages a stored XSS vulnerability in Typecho 1.3.0 to inject malicious JavaScript, which then modifies the theme editor to include a PHP webshell. The attacker can execute arbitrary commands via an interactive shell.

The repository contains functional exploit code for CVE-2024-35540, targeting Typecho <= 1.3.0. The exploit demonstrates a race condition vulnerability by spamming comments with spoofed client IPs, leveraging JavaScript token calculation and concurrent HTTP requests.