CVE-2018-8097

CVE-2018-8097 PoC This is a simple python Proof of Concept script demonstrating the CVE-2018-8097, affecting the PyEve library for versions 0.7.5 Usage usage: cve20188097.py -h -u URL -c COMMAND options: -h, --help show this help message and exit -u URL, --url URL Target URL where you can use the...

CVE-2018-8097-PoC

CVE-2018-8097 POC for CVE-2018-8097 This script exploits CVE-2018-8097 and can retrieve files and contents using a time based blind RCE method. Usage python cve-2018-8097.py -h -u URL -c COMMAND -t TIME -id OBJECTID -d FILEPATH options: -h, --help show this help message and exit -u, --url URL...

Eve allows execution of arbitrary code

io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...

GHSA-8JXQ-75RW-FHJ9 Eve allows execution of arbitrary code

io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...

Eve allows execution of arbitrary code

io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...

PYSEC-2018-8

io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...

CVE-2018-8097

io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...

CVE-2018-8097

CVE-2018-8097 affects Eve (aka pyeve) prior to 0.7.5. The vulnerability resides in io/mongo/parser.py where the where parameter enables Code Injection, allowing remote execution of arbitrary code. Multiple sources corroborate remote-code-execution via this parameter. A PoC/notice exists showing f...

CVE-2018-8097

io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...

CVE-2018-8097: Improper Control of Generation of Code

io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...