CodeIgniter4 upload validation bypass leading to RCE

This repository is a small standalone Python exploit for CVE-2026-63223, an unauthenticated CodeIgniter 4 file-upload-to-RCE vulnerability affecting versions prior to 4.7.4. The repo contains 5 files: a README with vulnerability background and usage examples, one Python exploit script (cve_2026_63223.py), requirements.txt, and standard metadata files. The exploit is not part of a larger framework. The main capability is exploitation of vulnerable upload handlers that rely on CodeIgniter 4 is_image/mime_in validation. The script builds a PHP webshell prefixed with valid image magic bytes (GIF/JPEG/PNG) so the upload passes content-based image checks while retaining a .php filename. Once uploaded into a web-accessible PHP-executable directory, the script accesses the resulting shell URL and executes arbitrary commands through a query parameter. The embedded payload also supports follow-on file upload, making it more than a simple verifier. Based on the visible code and README, the exploit supports single-target mode, mass scanning from a target list, configurable upload endpoint and form field, selectable magic-byte disguise method (gif/jpg/png), custom shell filename, custom command execution, interactive pseudo-shell mode, output saving, and multithreaded operation. The script uses requests/urllib3, disables TLS warnings, and includes result tracking and threaded scanning logic. The visible payload template confirms command execution via system($_REQUEST["c"]) and file upload via $_FILES["f"]. Fingerprintable targets and paths are mostly user-supplied rather than hardcoded infrastructure: the default upload endpoint is /upload/avatar, the default upload field is avatar, and the expected shell location is under /uploads/ with a .php filename such as shell.php. Example execution URLs include /uploads/shell.php?c=CMD. No attacker-controlled callback IPs, C2 domains, or fixed external infrastructure are present in the exploit itself. Overall, this is an operational standalone web exploit for pre-auth remote code execution against vulnerable CodeIgniter 4 applications with unsafe upload handling. It performs both exploitation and post-exploitation command execution rather than mere detection.

This repository is a real PoC exploit and self-contained vulnerable lab for CVE-2026-63223, a CodeIgniter 4 unrestricted file upload issue leading to RCE. The repo has 10 files and is organized into: (1) a Python exploit script in exploit/exploit.py, (2) a Dockerized vulnerable CodeIgniter 4.7.3 application, and (3) supporting documentation in README.md. The main exploit capability is bypassing CodeIgniter 4 upload validation rules is_image and mime_in by prepending valid image magic bytes to a PHP payload while keeping an executable filename extension such as .php or .phtml. The exploit script generates these polyglot payloads for GIF, JPEG, or PNG disguises, uploads them via multipart/form-data, attempts to discover the resulting upload path, and then triggers command execution through a webshell parameter c. It supports both single-command execution and an interactive shell mode, making it more than a simple detector but still a straightforward PoC/operational exploit. The vulnerable application is intentionally configured to demonstrate the bug. In vulnerable-app/app/Controllers/Upload.php, the avatar() handler uses is_image only, document() uses mime_in only, and both save the uploaded file using getClientName() into FCPATH . 'uploads/' without renaming or extension filtering. Because uploads are stored under the web root (/var/www/html/public/uploads in the Docker lab), a successfully uploaded PHP file becomes directly reachable and executable. The safe() handler shows the patched pattern by combining is_image with ext_in. Routes are defined in vulnerable-app/app/Config/Routes.php and expose /upload/avatar and /upload/document as vulnerable endpoints, /upload/safe as a control, and /health as a lab check. The HTML view files are simple upload forms that surface success/error messages and, in the vulnerable avatar form, link directly to the uploaded file path. The Dockerfile builds a PHP 8.2 Apache environment, installs CodeIgniter 4.7.3 specifically, enables mod_rewrite, sets the document root to /var/www/html/public, and ensures the uploads directory is writable. docker-compose.yml publishes the lab on localhost:8080 and mounts the vulnerable controller, routes, and views into the container. Overall, the repository’s purpose is to demonstrate and validate unauthenticated remote code execution via unsafe file upload handling in vulnerable CodeIgniter 4 deployments. It is not a framework module, not a fake exploit, and not merely a detection script.