CVE-2024-39205

This repository contains a functional exploit for CVE-2024-39205, which leverages a js2py sandbox escape (CVE-2024-28397) in pyload-ng's `/flash/addcrypted2` API endpoint to achieve remote code execution. The exploit bypasses localhost restrictions via HTTP headers and executes arbitrary shell commands on vulnerable systems.

This exploit leverages a JavaScript-based reverse shell payload, likely targeting a Node.js or similar environment vulnerable to CVE-2024-39205. It uses prototype manipulation and subprocess execution to achieve remote code execution (RCE).