CVE-2026-27174

This repository contains a functional proof-of-concept exploit for CVE-2026-27174, an unauthenticated remote code execution vulnerability in MajorDomo's admin panel. The exploit leverages a missing exit after authentication redirect, allowing arbitrary PHP code execution via an exposed eval() function in the AJAX handler.

This repository contains a functional proof-of-concept exploit for CVE-2026-27174, an unauthenticated remote code execution vulnerability in MajorDomo's admin panel. The exploit leverages a missing exit after authentication redirect, allowing arbitrary PHP code execution via an exposed eval() function in the AJAX handler.

This Metasploit module exploits an unauthenticated RCE vulnerability in MajorDoMo by leveraging a missing exit statement after a redirect, allowing direct eval() execution of PHP code via GET parameters.