Exploitation Summary
EIP tracks 5 public exploits for CVE-2026-22241. PoCs published by unico007x, XiaomingX, 0xBlackash.
AI-analyzed exploit summary This exploit demonstrates a remote code execution (RCE) vulnerability in GUnet OpenEclass E-learning platform versions prior to 4.2. It leverages an unrestricted file upload flaw in the theme options module to upload a malicious PHP shell, allowing arbitrary command execution.
Description
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system. The main cause of the issue is that no validation or sanitization of the file's present inside the zip archive. This leads to remote code execution on the web server. Version 4.2 patches the issue.
Exploits (5)
This exploit demonstrates a remote code execution (RCE) vulnerability in GUnet OpenEclass E-learning platform versions prior to 4.2. It leverages an unrestricted file upload flaw in the theme options module to upload a malicious PHP shell, allowing arbitrary command execution.
This repository provides a functional exploit for CVE-2026-22241, demonstrating an unrestricted file upload vulnerability in OpenClass Educational Infrastructure leading to RCE. It includes a lab environment setup and a malicious PHP file for exploitation.
This repository provides a detailed technical analysis of CVE-2026-22241, an unrestricted file upload vulnerability in Open eClass's Theme Import feature, leading to RCE. It includes root cause analysis, mitigation steps, and references to official advisories.
This repository provides a functional exploit for CVE-2026-22241, demonstrating an unrestricted file upload vulnerability in OpenClass Educational Infrastructure leading to RCE. It includes a lab environment setup and a malicious PHP file (evil.php) that executes arbitrary commands via a GET parameter.
This is a functional exploit for CVE-2026-22241, an unrestricted file upload vulnerability in Open eClass. It automates authentication, ZIP file creation with a malicious PHP payload, upload, and execution of arbitrary commands via a web shell.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H