admin/GobyVuls
1
0
Fork 0
mirror of https://github.com/gobysec/GobyVuls.git synced 2025-05-05 10:16:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
GobyVuls/Casdoor/CVE-2022-24124
History

README.md

Casdoor 1.13 sqli (CVE-2022-24124)

Casdoor is an open source identity and access management (IAM) / single sign-on (SSO) platform with a web UI that supports OAuth 2.0 / OIDC and SAML authentication. Before Casdoor 1.13.1, there is a SQL injection vulnerability in api/get-organizations, and attackers can use the vulnerability to obtain sensitive information such as database users and passwords.

FOFA query rule: banner="casdoor_session_id" || header="casdoor_session_id"

Demo

Casdoor_1_13sqli_CVE_2022_24124