CVE-2023-49070

ofbiz-xmlrpc-rce CVE-2023-49070 Apache OFBiz XML-RPC 사전 인증 역직렬화 RCECVE-2023-49070에 대한 PoC입니다. 인증 우회 경로를 통해 레거시 /webtools/control/xmlrpc 엔드포인트에 접근할 수 있게 되며, 이 엔드포인트는 XML-RPC 파라미터 안에 밀반입된 공격자 제어 Java 객체를 역직렬화합니다. ⚠️ 승인된 보안 테스트 전용입니다. 본인이 소유하거나 명시적으로 테스트 권한을 부여받은 시스템CTF/랩 환경, 서명된 범위가 있는 계약 등에만 실행하십시오...

VulnCheck KEV: CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

CVE-2023-51467-EXPLOIT

CVE-2023-51467 - Обход аутентификации в Apache OFBiz Эта уязвимость позволяет злоумышленникам обойти аутентификацию, что приводит к эксплуатации подделки серверных запросов SSRF. При отправке веб-запроса по конкретному пути /webtools/control/ping?USERNAME&PASSWORD=test&requirePasswordChange=Y...

Apache OFBiz Forgot Password Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache OFBiz Forgot Password Directory Traversal', 'Description' = %q Apache OFBiz versions prior to 18.12.13 are vulnerable to a path traversal...

Exploit for Path Traversal in Apache Ofbiz

Apache OfBiz vulns POC for CVE-2024-32113 The USERNAME...

CVE-2019-0189

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the...

CVE-2019-0189

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the...

Apache OFBiz 16.11.04 XML Injection

Exploit Title: Apache OFBiz 16.11.04 - XML External Entity Injection Date: 2018-10-15 Exploit Author: Jamie Parfet Vendor Homepage: https://ofbiz.apache.org/ Software Link: https://archive.apache.org/dist/ofbiz/ Version: xXx xXx """ if lensys.argv = 1: print' Apache OFBiz 16.11.04 XXE' print' Use...

Apache OFBiz - FULLADMIN Creator PoC Payload

No description provided by source. / Apache OFBiz FULLADMIN Creator PoC Payload. CVE: CVE-2010-0432 By: Lucas Apa lucas -at- bonsai-sec.com . Bonsai Information Security http://www.bonsai-sec.com/ / var username = 'bonsaiUser'; var password = 'bonsaiPass'; var nodes =...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Apache Open For Business Project aka OFBiz 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via 1 the productStoreId parameter to control/exportProductListing, 2...