CVE-2024-36104-PoC

CVE-2024-36104-PoC Proof-of-concept for CVE-2024-36104, an unauthenticated remote code execution vulnerability in Apache OFBiz before 18.12.14. OFBiz's ControlServlet resolves an unauthenticated view forgotPassword before canonicalizing the request path. Appending /%2e/%2e/ collapses back onto...

CVE-2024-32113

CVE-2024-32113 Apache OFBIZ Path traversal leading to RCE EXP. Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.14not include. Users are recommended to upgrade to version 18.12.14 , which fixes...

CVE-2024-32113-POC

Apache OfBiz vulns POC for CVE-2024-32113 The USERNAME and PASSWORD params can be provided at the /ecomseo/AnonContactus interface, which is publicly accessible to anyone. POC1：RCE curl --noproxy '' -k --location --request POST...

Apache OFBiz CVE-2023-51467 Auth Bypass Detection

Detects CVE-2023-51467 by accessing /webtools/control/ping with empty credentials and requirePasswordChange=Y, then confirming Groovy execution via ProgramExport. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz CVE-2023-51467 authentication bypass detection.""" import re from kittysploi...

Apache OFBiz Auth Bypass Groovy RCE (CVE-2023-51467)

Exploits CVE-2023-51467 authentication bypass empty credentials + requirePasswordChange=Y to reach /webtools/control/ProgramExport and run arbitrary Groovy via groovyProgram. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz auth bypass + Groovy RCE...