Arbitrary File Upload in Podlove Podcast Publisher for WordPress

The repository contains a standalone Python exploit driver (CVE-2026-13001.py), a PHP payload generator (payload.php), a README, and a gitignore file. Its stated purpose is exploitation of CVE-2026-13001 in Podlove Podcast Publisher <=4.5.1. The intended web attack hex-encodes an attacker payload URL ending in a query-string image extension such as shell.php?.gif, then invokes Podlove's unauthenticated image-cache handler. The claimed basename-versus-parse_url extension mismatch causes a GIF89a/PHP polyglot to pass image validation while being written with a .php extension. The Python tool supports individual targets and multithreaded target lists, can host a generated payload locally, probes for the saved cache path, and reports shell/RCE status. payload.php serves the same polyglot with an image/gif content type and emits a token in an HTTP header. The generated payload is a fully functional PHP file-manager shell rather than a harmless proof-of-concept: it supports arbitrary OS command execution, file enumeration, uploads, and deletion after token validation. A notable and unrelated risk exists in CVE-2026-13001.py: its scanningports() function silently decodes two GitHub raw URLs, downloads either sysnc.py on Windows or installmegaexploit.sh on non-Windows systems, then executes that code locally while suppressing output and exceptions. This is concealed operator-host compromise/staging behavior and is unrelated to Podlove exploitation. It should be treated as untrusted and unsafe to run.

Repository contains a working Python exploit and a PHP/GIF polyglot payload for CVE-2026-13001, targeting Podlove Podcast Publisher on WordPress up to 4.5.1. The exploit abuses inconsistent extension parsing in the plugin’s image cache feature: validation logic treats a URL like shell.php?.gif as a GIF, while save logic derives the extension from the parsed path and stores it as .php. The repository structure is small and focused: exploit.py is the main operational component; shell_polyglot.gif.php is the payload; README.md explains usage and attack flow; analysis/CVE_COMPARISON.md and analysis/TECHNICAL_ANALYSIS.md provide vulnerability background and patch-bypass details; requirements.txt lists Python dependencies. The Python tool supports single-target exploitation, bulk processing from a target list, shell URL prediction based on the cache hash/path scheme, optional vulnerability verification, and an interactive command shell against the uploaded webshell. The included payload executes arbitrary OS commands passed via the cmd parameter using PHP system(). Overall, this is a real unauthenticated RCE exploit repository, not merely a detector or write-up.

The repository contains a single PHP file, 'sadboyz', which is an operational web shell disguised with a GIF header ('GIF89a') to appear image-like while still containing executable PHP. It is not a framework module and consists entirely of one self-contained server-side payload. Core capabilities: - Password-gated access using GET parameter 's'; default password is 'sadboy'. If absent or incorrect, the script returns a fake 404 page. - Remote command execution via GET parameter 'c', using whichever PHP execution primitive is available: system, passthru, shell_exec, exec, or popen. - File upload via multipart POST field 'f', optionally renamed with POST parameter 'n', saved into the script's current directory. - File download via GET parameter 'dl'. - File deletion via GET parameter 'del'. - Host reconnaissance via GET parameter 'info', exposing UID/user context, uname, PHP version, SAPI, current directory, HOME, document root, server software, and disabled PHP functions. - Directory browsing through an HTML interface that lists files in the current directory and provides download/delete links. Structure and purpose: - Single-file PHP implant with embedded HTML/CSS UI. - Designed for post-compromise persistence and interactive server control through a browser. - The title/banner references 'CVE-2026-13001', but the code itself is a generic web shell and does not contain exploit logic for initial vulnerability triggering; instead, it appears intended to be uploaded after exploitation or used as the payload dropped by another exploit. Notable implementation details: - Uses basename() and a restrictive regex for uploaded filenames, reducing path traversal in upload naming. - File operations are constrained to the current directory by concatenating basename() with __DIR__. - Returns direct links to uploaded files using HTTP_HOST and PHP_SELF-derived paths. - Includes stealth elements: suppressed errors, unlimited execution time/memory, and fake 404 behavior for unauthorized access. Overall, this is a malicious authenticated PHP web shell providing browser-based RCE and file management on a compromised web server.

Repository contains a standalone exploit for CVE-2026-13001 affecting the Podlove Podcast Publisher WordPress plugin up to 4.5.1. Structure is minimal: a Python exploit driver (cve_2026_13001.py), a PHP payload generator/host file (payload.php), a README with exploitation details, and a requests-only dependency file. The Python script is the main entry point and implements target handling, optional mass scanning, a built-in HTTP payload server, and exploitation logic that abuses the plugin’s podlove_image_cache_url behavior to make the target fetch an attacker-controlled GIF89a/PHP polyglot. The embedded PHP payload is not just a command stub; it is a token-gated file-manager web shell supporting command execution through parameter c, file upload via multipart POST, directory listing, and file deletion via del. The exploit is operational rather than a simple detector because it automates delivery of the payload and attempts to reach the resulting shell URL. The repository targets a web/network attack surface and relies on the target being able to retrieve remote attacker-hosted content and execute cached .php files under /wp-content/cache/podlove/. The README also documents the vulnerable request pattern, expected shell path, and example attacker infrastructure, which align with the code’s stated purpose.

Repository contains a single Python exploit script and a README. The main file, CVE-2026-13001.py, is a standalone exploit for CVE-2026-13001 affecting Podlove Podcast Publisher for WordPress up to 4.5.1. It targets an unauthenticated image-cache feature that can be triggered through GET parameters on the public site. The exploit abuses inconsistent extension parsing: the target validates the remote URL as an image using a basename/query-string influenced extension, but saves the fetched file using the path-derived extension, allowing a URL like shell.php?.gif to be accepted as an image yet written as a PHP file. The script is operational rather than a simple detector. It supports single-target and batch modes, uses threading for concurrent scans, performs version checks against plugin readme files, triggers the vulnerable cache fetch endpoint, predicts the resulting cache path using md5(url+filename), and verifies code execution by requesting the cached file. It can either host the payload locally via a built-in Python HTTP server exposed through a configured public hostname/port, or use a hardcoded externally hosted payload URL. The embedded payload is a GIF89a/PHP polyglot web shell that renders an upload form and accepts file uploads, enabling follow-on compromise after initial RCE. Repository structure is minimal: one Python PoC/exploit and one explanatory README. No external exploit framework is used. The code includes operator-oriented UX features such as rich terminal output, progress display, result saving, and success logging, indicating a practical exploitation tool rather than a theoretical proof-only sample.