135 matches found
CVE-2022-24637
CVE-2022-24637 Open Web Analytics OWA - 未認証のリモートコード実行 https://vulners.com/cve/CVE-2022-24637 例 python3 exploit.py -u admin -p hacker http://target.org 10.10.11.12 4444...
CVE-2022-24637
CVE-2022-24637 Open Web Analytics 1.7.3 - リモートコード実行エクスプロイト v2 Open Web Analytics 1.7.3 - RCE の実用的なエクスプロイト、pentestmonkey の PHP リバースシェル で拡張、キャッシュ内のユーザーが見つからない問題を修正。 元のエクスプロイトはこちらにあります。 使い方 攻撃マシンのIPアドレスとポートを php-reverse-shell.php ファイルに追加し、exploit.py を引数 -u（脆弱なターゲットURLを指定）で実行してください。 python3 exploit.p...
CVE-2022-24637
脆弱なアプリケーション Open Web Analytics OWA 1.7.4 より前のバージョンでは、認証されていないリモート攻撃者が機密ユーザー情報を取得でき、キャッシュハッシュを利用して管理者権限を獲得することができます。これは、' を実行し IPAddress を取得、例: 172.22.0.2 Database Port: 3306 Database Name: owa Database User: owa Database Password: Demo12+ 続行 Site Domain: http://127.0.0.1 Admin name: admin E-Mail:...
CVE-2022-24637
CVE-2022-24637 Open Web Analytics OWA 1.7.3における未認証RCEのエクスプロイト。この作業はhttps://devel0pment.de/?p=2494に基づいています。 免責事項：このスクリプトはシステムのセキュリティ監査のために作成されています。このスクリプトは、自身のシステムまたは明示的な許可を得たシステムに対してのみ使用してください。...
CVE-2022-24637
CVE-2022-24637 未認証のRCE in Open Web Analytics バージョン / newPassword YourIp YourPort シェルを取得するために数回実行する必要があるかもしれません。 スクリプトは改善可能です。...
CVE-2022-24638
EXPLOITDBに掲載: https://www.exploit-db.com/exploits/51026 このバージョンはFalse Negativeを防ぐために修正されています。 CVE-2022-24637 Open Web Analytics OWA 1.7.4 における未認証RCEのエクスプロイト。この作業は https://devel0pment.de/?p=2494 に基づいています。 免責事項: このスクリプトはシステムのセキュリティ監査を目的としています。自分のシステム、または書面による許可を得たシステムでのみ使用してください。...
CVE-2022-24637
CVE-2022-24637 — Open Web Analytics 1.7.4 より前 Open Web Analytics OWA における、権限昇格につながる可能性のある重大な未認証情報漏えい問題に関する防御的な注意事項。 echoCTF の Fruityloops ボックスに取り組んでいる際に遭遇したもので、Open Web Analytics 1.7.3 が動作していた。 概要 項目| 詳細 ---|--- CVE| CVE-2022-24637 製品| Open Web Analytics 影響を受けるバージョン| 1.7.4 より前 のバージョン 1.7.3 を含む...
CVE-2026-97865
A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...
EUVD-2026-87090
A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...
CVE-2026-97865 Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization
A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...
CVE-2026-97865
A security flaw in Open-Web-Analytics (up to version 1.8.1) allows for remote deserialization . The vulnerability exists within the Event::loadFromArray function in the queue.php file of the Remote Event Queue Endpoint component. An attacker can initiate this attack remotely by performing manipul...
CVE-2026-97865 Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization
A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...
CVE-2026-97865 Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization
A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...
PT-2026-98852
Name of the Vulnerable Software and Affected Versions Open-Web-Analytics versions prior to 1.8.2 Description A flaw in the Remote Event Queue Endpoint component allows remote attackers to trigger deserialization by manipulating the Event::loadFromArray function within the queue.php file...
CVE-2026-97865: Deserialization of Untrusted Data
A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...
Open Web Analytics 1.7.3 - Remote Code Execution
Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '?php instead of the intended "?php sequence aren't handled by the PH...
Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics
CVE-2022-24637 — Open Web Analytics prior to 1.7.4 Defensiv...
CVE-2026-86810
A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...
CVE-2026-86810
Open-Web-Analytics (up to 1.9.1) contains an improper authentication vulnerability in the checkCapabilityAndAuthenticateUser function within Core/Controller.php (Controller component). A remote, unauthenticated attacker can manipulate this function to bypass authentication checks. The CVSS 3.1 sc...
CVE-2026-86810 Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication
A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...