Invalid drop of partially initialized instances in Wasmtime pooling instance allocator

This repository is a small, standalone authenticated RCE exploit for m1k1o's Blog, targeting CVE-2022-23626 despite the Python filename being inconsistently named cve-2022-23636.py. The repo contains only two files: one Python exploit script and one README with usage and vulnerability context. The exploit flow is straightforward: it first performs a GET to the supplied base URL to extract a PHPSESSID cookie and a CSRF token from the page content, then authenticates to /ajax.php using supplied credentials, then abuses the vulnerable /ajax.php?action=upload_image endpoint to upload a PHP webshell named shell.gif.php with a GIF89a magic header to bypass naive file validation. After upload, it requests the returned path directly to execute the payload. The payload supports two modes: arbitrary command execution supplied with --command, or a reverse shell using php -r with fsockopen to an attacker listener. This is a real exploit, not a detector, and it provides practical post-auth remote code execution against vulnerable deployments where uploaded PHP files are web-accessible and executable. The code is simple and operational, but not highly robust: error handling is minimal, token extraction is brittle string-splitting, and the trigger function appears syntactically incomplete in the provided content, though the intended behavior is clear from context and README.