CVE-2024-56145

This repository contains a functional exploit for CVE-2024-56145, targeting a Remote Code Execution (RCE) vulnerability in Craft CMS. The exploit leverages improper handling of user-supplied template paths to achieve RCE via a crafted FTP server and reverse shell payloads.

This repository contains a functional exploit for CVE-2024-56145, targeting CraftCMS via template path manipulation and SSTI (Server-Side Template Injection). The PoC includes an FTP server to serve malicious templates and multiple payloads for command execution.

This repository provides a lab environment to reproduce CVE-2024-56145, an RCE vulnerability in CraftCMS when `register_argc_argv` is enabled in php.ini. It includes Docker setup and configuration files to simulate the vulnerable environment.

This Metasploit module exploits a Twig template injection vulnerability in Craft CMS by abusing the --templatesPath argument to load arbitrary templates via FTP, leading to Remote Code Execution (RCE). It sets up a fake FTP server to serve malicious Twig templates that execute system commands when rendered by the vulnerable Craft CMS instance.