admin/GobyVuls
1
0
Fork 0
mirror of https://github.com/gobysec/GobyVuls.git synced 2025-06-20 18:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12 from corp0ra1/master

Browse Source 
add cve
This commit is contained in:
tardc 2021-08-02 14:58:39 +08:00 committed by GitHub
commit 8229a84e96
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
KlogServer/CVE-2020-35729/CVE_2020_35729.gif Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 970 KiB

11
KlogServer/CVE-2020-35729/README.md Normal file
View File

@ -0,0 +1,11 @@
# Klog Server Unauth RCE(CVE-2020-35729)
The 'authenticate.php' file uses the 'user' HTTP POST parameter in a call to the 'shell_exec()' PHP function without appropriate input validation,allowing arbitrary command execution as the apache user.
**Affected Version**: ≤2.4.1
**FOFA query rule**: [title="KLog Server" && body="authenticate.php"](https://fofa.so/result?qbase64=dGl0bGU9IktMb2cgU2VydmVyIiYmYm9keT0iYXV0aGVudGljYXRlLnBocCI%3D)
# Demo
![](CVE_2020_35729.gif)

BIN
Mida_eFramework/CVE-2020-15920/CVE_2020_15920.gif Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 713 KiB

11
Mida_eFramework/CVE-2020-15920/README.md Normal file
View File

@ -0,0 +1,11 @@
# Mida eFramework ajaxreq.php RCE(CVE-2020-15920)
There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.
**Affected Version**: ≤2.9.0
**FOFA query rule**: [body="eFramework.css" && body="MUP"](https://fofa.so/result?qbase64=Ym9keT0iZUZyYW1ld29yay5jc3MiICYmIGJvZHk9Ik1VUCI%3D)
# Demo
![](CVE_2020_15920.gif)

BIN
Nette_Framework/CVE-2020-15227/CVE_2020_15227.gif Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 897 KiB

11
Nette_Framework/CVE-2020-15227/README.md Normal file
View File

@ -0,0 +1,11 @@
# Nette Framework RCE(CVE-2020-15227)
Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
**Affected Version**: before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6
**FOFA query rule**: [app="NetteFramework"](https://fofa.so/result?qbase64=YXBwPSJOZXR0ZUZyYW1ld29yayI%3D)
# Demo
![](CVE_2020_15227.gif)