PHP Code Injection in ISPConfig Language File Editor

This repository contains a working exploit for CVE-2023-46818, targeting ISPConfig versions <= 3.2.11. The exploit is implemented in a single Python script (CVE-2023-46818.py) and is accompanied by a README.md with technical details and usage instructions. The exploit requires valid credentials for the ISPConfig admin panel. It abuses the /admin/language_edit.php endpoint to inject a PHP web shell (shell.php) into the admin directory by exploiting insufficient input validation in the 'records[]' parameter. The attacker can then interactively execute arbitrary system commands on the server via the web shell, using a custom HTTP header to transmit commands. The repository is structured simply, with the main exploit script and documentation, and provides a reliable method for authenticated remote code execution on vulnerable ISPConfig installations.

This repository contains a Python proof-of-concept exploit for CVE-2023-46818. The exploit targets a web application vulnerable to an authenticated file upload/injection flaw. The structure consists of a README.md (usage instructions and context) and exploit.py (the main exploit script). The exploit works by authenticating to the target web application using provided credentials, exploiting a vulnerability in the language file editing functionality to upload a PHP webshell (46818.php) to the /admin/ directory, and then providing an interactive shell interface to execute arbitrary system commands via the webshell. The exploit requires network access to the target and valid credentials. The endpoints involved are the login page, the language edit page (for injection), and the uploaded webshell. The payload is a simple PHP webshell that executes commands passed via the 'l' GET parameter. The exploit is operational and provides a working shell if the target is vulnerable and the credentials are valid.

This repository contains a Python exploit script (CVE-2023-46818.py) targeting ISPConfig versions <= 3.2.11 with the 'admin_allow_langedit' option enabled. The exploit requires valid admin credentials and works by abusing the language file editor to inject a PHP webshell (sh.php) into the /admin/ directory. The script first authenticates to the target, retrieves CSRF tokens, and then sends a payload that writes the webshell. Once deployed, the script provides an interactive shell interface, sending commands via a custom HTTP header to the webshell and displaying the output. The repository includes a README with usage instructions and references, a requirements.txt for dependencies (requests, urllib3), and a .gitignore. The main attack vector is network-based, targeting the ISPConfig web interface endpoints. The exploit is operational, providing a working remote shell if the target is vulnerable and properly configured.

This repository contains a Metasploit module (ispconfig_language_edit.rb) that exploits a PHP code injection vulnerability (CVE-2023-46818) in ISPConfig versions before 3.2.11p1. The exploit targets the language file editor feature, which is accessible to authenticated administrators when the 'admin_allow_langedit' option is enabled. The module authenticates to the ISPConfig admin panel, injects a PHP webshell via the vulnerable endpoint (/admin/language_edit.php), and can establish a Meterpreter reverse shell or provide command execution via HTTP headers. The repository consists of a README with usage instructions and the main Ruby exploit file. The exploit is weaponized, leveraging Metasploit's payload system for flexible post-exploitation. Key endpoints include the ISPConfig login page and the language editor. The exploit requires valid admin credentials and specific configuration on the target.

This repository contains a Bash exploit script (exploit.sh) and a README.md for CVE-2023-46818, a PHP code injection vulnerability in ISPConfig <= 3.2.11. The exploit requires valid ISPConfig admin credentials. The script logs in to the ISPConfig admin panel, retrieves CSRF tokens, and exploits the /admin/language_edit.php endpoint by injecting PHP code via the 'records[]' parameter. This code writes a web shell (sh.php) to the /admin/ directory. The attacker can then interactively execute arbitrary system commands on the target server by sending base64-encoded commands via a custom HTTP header to the web shell. The repository is structured simply, with the main exploit logic in exploit.sh and usage instructions in the README. The exploit is operational, providing a working web shell payload and an interactive shell interface for the attacker.

This repository contains a Bash proof-of-concept exploit for CVE-2023-46818, an authenticated PHP code injection vulnerability in ISPConfig versions <= 3.2.11. The exploit consists of a single Bash script (exploit.sh) and a README.md with usage instructions and vulnerability details. The script automates the exploitation process: it authenticates to the ISPConfig admin interface, retrieves CSRF tokens, and injects a PHP web shell (sh.php) into the /admin/ directory by abusing the language_edit.php endpoint's records[] parameter. The web shell allows the attacker to execute arbitrary system commands on the target server by sending base64-encoded commands in a custom HTTP header. The exploit requires valid admin credentials and network access to the ISPConfig instance. No hardcoded endpoints are present; the target URL is supplied as an argument. The repository is operational and provides a working exploit with a persistent payload.

This repository contains a Python exploit (exploit.py) targeting CVE-2023-46818, a PHP code injection vulnerability in ISPConfig version 3.2.11 and earlier. The exploit requires valid ISPConfig credentials and automates the attack by logging in, exploiting the vulnerable language_edit.php endpoint, and injecting a PHP web shell (sh.php) onto the server. The web shell allows the attacker to execute arbitrary system commands remotely via HTTP requests, with command output clearly delimited for parsing. The repository consists of a README.md describing the exploit and a single Python script implementing the attack. The exploit is operational, providing a working remote shell, and is not part of any known exploit framework.

This repository contains a Python exploit script (CVE-2023-46818.py) and a README.md. The exploit targets a vulnerability in ISPConfig (version 3.2.11 and prior) where the 'records' POST parameter to '/admin/language_edit.php' is not properly sanitized, allowing an authenticated admin to inject arbitrary PHP code. The script logs in to the ISPConfig admin interface, retrieves CSRF tokens, and injects a base64-encoded PHP webshell ('sh.php') into the '/admin/' directory. The attacker can then interactively execute system commands on the target server via the webshell, using a custom HTTP header. The README provides usage instructions, affected versions, and a sample run. The exploit requires valid admin credentials and network access to the ISPConfig admin interface. The main endpoints involved are '/login/', '/admin/language_edit.php', and the dropped webshell at '/admin/sh.php'.

This repository contains a Python proof-of-concept exploit for CVE-2023-46818, a PHP code injection vulnerability in ISPConfig 3.2.11 and earlier. The exploit requires valid administrator credentials to log in to the ISPConfig admin panel. It targets the /admin/language_edit.php endpoint, exploiting improper sanitization of the 'records' POST parameter to inject arbitrary PHP code. The exploit uploads a PHP web shell (sh.php) to the server, which allows the attacker to execute arbitrary system commands via a custom HTTP header. The repository consists of two files: a README.md with usage instructions and vulnerability details, and exploit.py, the main exploit script. The exploit is operational and provides an interactive shell to the attacker, but is not weaponized for mass exploitation.