CVE-2024-23897

Usage root@kitploit: python poc.py usage: python poc.py http://127.0.0.1:8888/ /etc/passwd...

CVE-2023-29839

CVE-2023-29839 Hotel Druid 3.0.4 Stored Cross Site Scripting Vulnerability CMS Link: https://www.hoteldruid.com/ Version Affected: 3.0.4 Severity & CVSS: 5.4 Medium | Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N A Stored Cross Site Scripting XSS vulnerability exists in multiple pages in...

Apache Druid Kafka Connect - Remote Code Execution

The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API id: CVE-2023-25194 info: name: Apache Druid Kafka Conne...

CVE-2020-1958

PoC de CVE-2020-1958 CVE-2020-1958 es una vulnerabilidad de inyección LDAP de alta gravedad en Apache Druid 0.17.0. Permite a un atacante omitir el filtro de búsqueda LDAP y recuperar cualquier valor de atributo LDAP de usuarios que existan en el servidor LDAP. Del aviso oficial de Apache Druid:...

CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 Reflected Cross Site Scripting Vulnerability A reflected Cross Site Scripting vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. https://vulners.com/cve/CVE-2021-37833...

Apache-Druid-CVE-2021-25646

Apache-Druid-CVE-2021-25646 Youtube https://www.youtube.com/watch?v=-mdK5HSRiQU...

CVE-2021-25646-exp

CVE-2021-25646-exp Apache Druid CVE-2021-25646 Remote Code Execution Vulnerability Detection and Exploitation Tool Input domain name or ip:port to perform vulnerability detection For targets where the vulnerability is detected, command execution exploitation can be performed Supports single targe...

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - Remote Code Execution RCE Exploit by kaal Exploits 1. HotelDruidExploit.py This Exploit will create new room with our PHP payload as a room name . Usage : $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid 2...

CVE-2021-37832

CVE 2021-37832 Hotel Druid 3.0.2 SQL Injection Vulnerability A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti...

CVE-2021-25646

Apache Druid Remote Code Execution CVE-2021-25646 by j2ekim Usage root@kitploit: python exp.py -u --url -c --command python cve-2021-25646.py -u http://127.0.0.1:8888 -c "ping 5ap7ta.dnslog.cn" Vulnerability Reproduction Article https://www.adminxe.com/2109.html Disclaimer Any direct or indirect...

database-druid

druid encode java -cp druid-1.1.19.jar com.alibaba.druid.filter.config.ConfigTools 密码 Example: java -cp druid-1.1.19.jar com.alibaba.druid.filter.config.ConfigTools jas502n root@kitploit:...

RCE-PoC-CVE-2021-25646

CVE-2021-25646 Proof-of-Concept Go Version Overview This repository contains a proof-of-concept PoC exploit for CVE-2021-25646, a critical remote code execution vulnerability in Apache Druid. The exploit is written in Go and allows for interactive command injection via the terminal. Features...

CVE-2021-25646

CVE-2021-25646 Apache Druid Remote Code Execution Vulnerability Wker Script Under development... ===================================================================================== First of all, thanks to Wker for the remote assistance. The purpose of writing the script is for practice. Usage T...

CVE-2025-59390-

CVE-2025-59390- The attached POC will allow you to crack the Kerberos signiture in Apache Druid and also, any integer created by ThreadLocalRandom Advisory - Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret...

PocList

Este proyecto ha dejado de actualizarse temporalmente. Al actualizarlo en una etapa posterior, me di cuenta de dos problemas: primero, parece que mi declaración sobre la ley de seguridad en el repositorio no fue lo suficientemente clara, lo que generó consecuencias que no deseaba. Segundo, al...

CVE-2021-25646

Apache Druid RCE title="druid" && title=="Apache Druid" POST /druid/indexer/v1/sampler?for=filter HTTP/1.1 Host: x.x.x.x:8888 Content-Length: 612 Accept: application/json, text/plain, / Origin: http://x.x.x.x:8888 User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko...

CVE-2021-36749

CVE-2021-36749 Apache Druid: lectura de archivos arbitraria Versiones afectadas: versiones = 0.21.1 Se pueden utilizar los dos métodos siguientes: Método de línea de comandos root@kitploit: curl http://127.0.0.1:8888/druid/indexer/v1/sampler?for=connect -H "Content-Type:application/json" -X POST ...

CVE-2021-36750

CVE-2021-36749 Acerca de - En el sistema de ingesta de Druid, el InputSource se utiliza para leer datos de una determinada fuente de datos. Sin embargo, el HTTP InputSource permite a los usuarios autenticados leer datos de otras fuentes distintas a las previstas, como el sistema de archivos local...

cve-2021-25646

Apache Druid Remote Code Execution Vulnerability Summary Apache Druid has released a security update announcing a remote code execution vulnerability, numbered CVE-2021-25646. Due to the lack of authorization and authentication by default in Apache Druid, attackers can send specially crafted...

Apache Druid - Local File Inclusion

Apache Druid ingestion system is vulnerable to local file inclusion. The InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t...