Authenticated Arbitrary PHP File Upload and Execution in GLPI

The repository contains two files: a standalone Python exploit, Exploit.py (14,942 bytes), and README.md (8,274 bytes). The Python entry point uses requests sessions and BeautifulSoup to authenticate, dynamically identify randomized login fields, and extract CSRF tokens from a meta tag or hidden input. Its visible orchestration enables PHP uploads, uploads a uniquely named payload, discovers the temporary-file directory, sets both global and user pdffont values to the payload path without its extension, creates a Computer record, and requests a PDF report. According to the README, TCPDF appends .php and includes the attacker-selected font file, converting local file inclusion into command execution. The payload accepts commands through the cmd query parameter and returns plain-text output; no reverse shell, exfiltration destination, or fixed external callback is shown. The tool supports a configurable command, reusable setup, and an optional interception proxy. Exploitation makes persistent application changes, while cleanup is documented only as manual steps. The README attributes the issue to CVE-2025-24801, claims GLPI 10.0.17 and earlier are affected, and reports testing on 10.0.7; these claims are not independently verified here. The supplied Python content is truncated, preventing full validation of upload and configuration-update implementations. Repository URL, git reference, and archive size were not supplied; their metadata fields are empty or use a zero placeholder.

This repository provides a working exploit for CVE-2025-24801, targeting GLPI version 10.0.17. The exploit is implemented in a single Python script (cve-2025-24801.py) and requires the attacker to have valid administrator credentials for the target GLPI instance. The script automates the process of uploading a PHP webshell to the server by abusing a Local File Inclusion (LFI) vulnerability, manipulating configuration settings, and leveraging the file upload functionality. Once the webshell is in place, the attacker can execute arbitrary commands on the server via HTTP requests. The repository also includes a README.md with usage instructions and a requirements.txt listing Python dependencies (beautifulsoup4, requests). The main attack vector is network-based, exploiting web endpoints exposed by the GLPI application. Several fingerprintable HTTP endpoints are used throughout the exploit process, including those for computer creation, configuration, file upload, and command execution via the webshell. The exploit is operational and provides a real, working method for achieving RCE on vulnerable GLPI installations.

This repository provides a proof-of-concept exploit for CVE-2025-24801, a local file inclusion (LFI) to remote code execution (RCE) vulnerability in GLPI version 10.0.17. The exploit is implemented in Python (exploit.py) and automates the following steps: authenticating to the GLPI web interface using valid technician credentials, enabling PHP file uploads by modifying document type settings, uploading a PHP reverse shell via the AJAX file upload endpoint, and instructing the user to manually trigger the LFI to execute the shell. The payload is a simple PHP reverse shell that connects back to the attacker's machine. The repository includes a requirements.txt for dependencies and a README.md with detailed usage instructions. The main attack vector is network-based, targeting the GLPI web application endpoints. The exploit is a functional proof-of-concept and requires some manual interaction to complete the RCE chain.