CVE-2024-23897

Usage root@kitploit: python poc.py usage: python poc.py http://127.0.0.1:8888/ /etc/passwd...

CVE-2025-59390-

CVE-2025-59390- The attached POC will allow you to crack the Kerberos signiture in Apache Druid and also, any integer created by ThreadLocalRandom Advisory - Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret...

CVE-2021-34045

CVE-2021-34045 druid unauthorized access batch scanning poc Tool Usage python3 CVE-2021-34045.py -u http://127.0.0.1:1111 单个url测试 python3 CVE-2021-34045.py -f url.txt 批量检测 Disclaimer Any direct or indirect consequences and losses caused by the dissemination or use of the information provided in...

Apache-Druid-CVE-2021-25646

Apache-Druid-CVE-2021-25646 Youtube https://www.youtube.com/watch?v=-mdK5HSRiQU...

CVE-2020-1958

CVE-2020-1958 PoC CVE-2020-1958 is high severity LDAP injection vulnerability in Apache Druid 0.17.0. It allows an attacker to bypass LDAP search filter and to retrieve any LDAP attribute values of users that exist on the LDAP server. From official Apache Druid advisory: When LDAP authentication ...

CVE-2021-25646

CVE-2021-25646 Apache Druid Remote Code Execution Vulnerability Wker Script Under development... ===================================================================================== First of all, thanks to Wker for the remote assistance. The purpose of writing the script is for practice. Usage T...

Apache Druid Kafka Connect - Remote Code Execution

The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API id: CVE-2023-25194 info: name: Apache Druid Kafka Conne...

Apache Druid - Remote Code Execution

Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server. id: CVE-2021-25646 info: name: Apache Druid - Remote Cod...

PocList

This project is temporarily paused. During later updates, I realized two issues: First, it seems my declaration of the Cybersecurity Law in the repository was insufficient, leading to some results I did not intend. Second, at the initial design stage of this project, I did not consider some...

database-druid

druid encode java -cp druid-1.1.19.jar com.alibaba.druid.filter.config.ConfigTools 密码 Example: java -cp druid-1.1.19.jar com.alibaba.druid.filter.config.ConfigTools jas502n root@kitploit:...

CVE-2021-25646-exp

CVE-2021-25646-exp Apache Druid CVE-2021-25646 herramienta de detección y explotación de ejecución remota de código Ingrese un nombre de dominio o IP:puerto para realizar la detección de vulnerabilidades Se puede ejecutar comandos en los objetivos vulnerables detectados Admite un solo objetivo...

CVE-2021-25646

Apache Druid Remote Code Execution CVE-2021-25646 by j2ekim Usage root@kitploit: python exp.py -u --url -c --command python cve-2021-25646.py -u http://127.0.0.1:8888 -c "ping 5ap7ta.dnslog.cn" Vulnerability Reproduction Article https://www.adminxe.com/2109.html Disclaimer Any direct or indirect...

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - Remote Code Execution RCE Exploit by kaal Exploits 1. HotelDruidExploit.py This Exploit will create new room with our PHP payload as a room name . Usage : $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid 2...

CVE-2021-37832

CVE 2021-37832 Hotel Druid 3.0.2 SQL Injection Vulnerability A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti...

Apache-Druid-CVE-2021-25646-Exploit

Apache Druid RCE Exploit CVE-2021-25646 Python exploit for Apache Druid Remote Code Execution via JavaScript code injection CVE-2021-25646. Description This script exploits an RCE vulnerability in Apache Druid versions 0.20.1 that allows arbitrary code execution through specially crafted sampler...

CVE-2021-25646

Apache Druid RCE title="druid" && title=="Apache Druid" POST /druid/indexer/v1/sampler?for=filter HTTP/1.1 Host: x.x.x.x:8888 Content-Length: 612 Accept: application/json, text/plain, / Origin: http://x.x.x.x:8888 User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko...

CVE-2023-29839

CVE-2023-29839 Hotel Druid 3.0.4 Stored Cross Site Scripting Vulnerability CMS Link: https://www.hoteldruid.com/ Version Affected: 3.0.4 Severity & CVSS: 5.4 Medium | Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N A Stored Cross Site Scripting XSS vulnerability exists in multiple pages in...

CVE-2021-36749

CVE-2021-36749 Apache Druid Arbitrary File Read Affected versions: version = 0.21.1 Either of the following two methods can be used Command Line Method root@kitploit: curl http://127.0.0.1:8888/druid/indexer/v1/sampler?for=connect -H "Content-Type:application/json" -X POST -d...

CVE-2021-36750

CVE-2021-36749 Acerca de - En el sistema de ingesta de Druid, el InputSource se utiliza para leer datos de una determinada fuente de datos. Sin embargo, el HTTP InputSource permite a los usuarios autenticados leer datos de otras fuentes distintas a las previstas, como el sistema de archivos local...

CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 Reflected Cross Site Scripting Vulnerability A reflected Cross Site Scripting vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. https://vulners.com/cve/CVE-2021-37833...