Backdrop CMS 1.27.1
Authenticated Remote Code Execution (RCE)
Poc Exploit

Backdrop CMS version 1.27.1 is vulnerable to authenticated remote code execution.
A user with installer privileges can upload a crafted module installation like,.tgz file via the manual project installer, which is then extracted and executed as PHP code.
The exploitation flow abuses the ajax and authorize.php batch endpoints to trigger a file write under /modules/<name>/, leading to web shell access.

git clone https://github.com/rvizx/backdrop-rce cd backdrop-rce python3 -m venv venv && source venv/bin/activate pip install -r requirements.txt # usage python3 exploit.py <url> <username> <password>

Example:

python3 exploit.py http://example.com rvz frm2XS42E@x23${!@3;x

Original PoC Exploit Link (ExploitDB) - Author: Ahmet Ümit BAYRAM