Arbitrary File Upload in Podlove Podcast Publisher for WordPress

The repository contains a single PHP file, 'sadboyz', which is an operational web shell disguised with a GIF header ('GIF89a') to appear image-like while still containing executable PHP. It is not a framework module and consists entirely of one self-contained server-side payload. Core capabilities: - Password-gated access using GET parameter 's'; default password is 'sadboy'. If absent or incorrect, the script returns a fake 404 page. - Remote command execution via GET parameter 'c', using whichever PHP execution primitive is available: system, passthru, shell_exec, exec, or popen. - File upload via multipart POST field 'f', optionally renamed with POST parameter 'n', saved into the script's current directory. - File download via GET parameter 'dl'. - File deletion via GET parameter 'del'. - Host reconnaissance via GET parameter 'info', exposing UID/user context, uname, PHP version, SAPI, current directory, HOME, document root, server software, and disabled PHP functions. - Directory browsing through an HTML interface that lists files in the current directory and provides download/delete links. Structure and purpose: - Single-file PHP implant with embedded HTML/CSS UI. - Designed for post-compromise persistence and interactive server control through a browser. - The title/banner references 'CVE-2026-13001', but the code itself is a generic web shell and does not contain exploit logic for initial vulnerability triggering; instead, it appears intended to be uploaded after exploitation or used as the payload dropped by another exploit. Notable implementation details: - Uses basename() and a restrictive regex for uploaded filenames, reducing path traversal in upload naming. - File operations are constrained to the current directory by concatenating basename() with __DIR__. - Returns direct links to uploaded files using HTTP_HOST and PHP_SELF-derived paths. - Includes stealth elements: suppressed errors, unlimited execution time/memory, and fake 404 behavior for unauthorized access. Overall, this is a malicious authenticated PHP web shell providing browser-based RCE and file management on a compromised web server.

Repository contains a standalone exploit for CVE-2026-13001 affecting the Podlove Podcast Publisher WordPress plugin up to 4.5.1. Structure is minimal: a Python exploit driver (cve_2026_13001.py), a PHP payload generator/host file (payload.php), a README with exploitation details, and a requests-only dependency file. The Python script is the main entry point and implements target handling, optional mass scanning, a built-in HTTP payload server, and exploitation logic that abuses the plugin’s podlove_image_cache_url behavior to make the target fetch an attacker-controlled GIF89a/PHP polyglot. The embedded PHP payload is not just a command stub; it is a token-gated file-manager web shell supporting command execution through parameter c, file upload via multipart POST, directory listing, and file deletion via del. The exploit is operational rather than a simple detector because it automates delivery of the payload and attempts to reach the resulting shell URL. The repository targets a web/network attack surface and relies on the target being able to retrieve remote attacker-hosted content and execute cached .php files under /wp-content/cache/podlove/. The README also documents the vulnerable request pattern, expected shell path, and example attacker infrastructure, which align with the code’s stated purpose.

Repository contains a single Python exploit script and a README. The main file, CVE-2026-13001.py, is a standalone exploit for CVE-2026-13001 affecting Podlove Podcast Publisher for WordPress up to 4.5.1. It targets an unauthenticated image-cache feature that can be triggered through GET parameters on the public site. The exploit abuses inconsistent extension parsing: the target validates the remote URL as an image using a basename/query-string influenced extension, but saves the fetched file using the path-derived extension, allowing a URL like shell.php?.gif to be accepted as an image yet written as a PHP file. The script is operational rather than a simple detector. It supports single-target and batch modes, uses threading for concurrent scans, performs version checks against plugin readme files, triggers the vulnerable cache fetch endpoint, predicts the resulting cache path using md5(url+filename), and verifies code execution by requesting the cached file. It can either host the payload locally via a built-in Python HTTP server exposed through a configured public hostname/port, or use a hardcoded externally hosted payload URL. The embedded payload is a GIF89a/PHP polyglot web shell that renders an upload form and accepts file uploads, enabling follow-on compromise after initial RCE. Repository structure is minimal: one Python PoC/exploit and one explanatory README. No external exploit framework is used. The code includes operator-oriented UX features such as rich terminal output, progress display, result saving, and success logging, indicating a practical exploitation tool rather than a theoretical proof-only sample.