CVE-2024-9441

This PoC exploits a command injection vulnerability in a PHP-based web application's forgot password functionality to achieve remote code execution. It injects a PHP shell into the server and executes arbitrary commands via base64-encoded POST requests.

This repository contains a functional PoC exploit for CVE-2024-9441, targeting Nortek Linear eMerge E3 systems. The exploit leverages a flaw in the password recovery feature to inject malicious PHP code, enabling pre-authentication remote code execution.

This Python script checks for CVE-2024-9441 by sending a command injection payload in the 'login_id' parameter and comparing response times to detect vulnerability. It uses a time-based approach to infer command execution.