gogsownz

GogsOwnz GogsOwnzは、Gogs/Giteaサーバーで管理者権限とRCEを取得するためのシンプルなスクリプトです。 Gogs/Giteaの脆弱性（CVE-2018-18925 、CVE-2018-20303 を含む）を悪用します。 法的免責事項 このスクリプトは現状のまま提供されます。保証はありません。自己責任で使用し、法律を遵守してください。 典型的な使用方法 - 完全な使用方法をお読みください 実行中のGogs/Giteaに関する情報を取得 root@kitploit: python3 gogsownz.py https://127.0.0.1:3000/ -v...

Gogs (Go Git Service) 0.11.66 - Remote Code Execution

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. id: CVE-2018-18925 info: name: Go...

Gogs Directory Traversal

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925...

CVE-2018-18925

Gogs 0.11.66 is vulnerable to remote code execution due to improper validation of session IDs, demonstrated by a ".." session-file forgery in the file.go session provider. The issue stems from session handling in the Macaron-based go-macaron/session code, allowing an attacker to map a crafted ses...

CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron...