jakabakos/php-payload-injection-to-pngs

Inject PHP payload into PNG files through PLTE chunks

Inject PHP code into PNG files through PLTE chunks

This repo is created for a blog post written at vsociety about SugarCRM RCE (CVE-2023-22952). The RCE vulnerability is present in

1. SugarCRM versions 11.0 (Enterprise, Professional, Sell, Serve, and Ultimate, pre-11.0.5), as well as
2. SugarCRM versions 12.0 Enterprise, Sell, and Serve (pre-12.0.2).

I am not the owner of this code. The original version of this generator PHP script can be found here. Based on this article.

With this script, you can inject PHP payload into PNG files through PLTE chunks. Usage:

php gen.php '<?php phpinfo() ?>' malicious.php