cve/2018/CVE-2018-1273.md

### [CVE-2018-1273](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1273)
![](https://img.shields.io/static/v1?label=Product&message=Spring%20Framework&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%20-%20Code%20Injection&color=brighgreen)

### Description

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

### POC

#### Reference
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html

#### Github
- https://github.com/0day666/Vulnerability-verification
- https://github.com/0xT11/CVE-POC
- https://github.com/20142995/Goby
- https://github.com/20142995/pocsuite
- https://github.com/20142995/pocsuite3
- https://github.com/20142995/sectool
- https://github.com/2lambda123/SBSCAN
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/AabyssZG/SpringBoot-Scan
- https://github.com/CLincat/vulcat
- https://github.com/Elsfa7-110/kenzer-templates
- https://github.com/HackJava/HackSpring
- https://github.com/HackJava/Spring
- https://github.com/HimmelAward/Goby_POC
- https://github.com/Ljw1114/SpringFramework-Vul
- https://github.com/NorthShad0w/FINAL
- https://github.com/Ostorlab/KEV
- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
- https://github.com/Secxt/FINAL
- https://github.com/SexyBeast233/SecBooks
- https://github.com/SugarP1g/LearningSecurity
- https://github.com/Threekiii/Awesome-POC
- https://github.com/Threekiii/Vulhub-Reproduce
- https://github.com/Tim1995/FINAL
- https://github.com/Whoopsunix/PPPVULNS
- https://github.com/XTeam-Wing/RedTeaming2020
- https://github.com/Z0fhack/Goby_POC
- https://github.com/Zero094/Vulnerability-verification
- https://github.com/asa1997/topgear_test
- https://github.com/ax1sX/SpringSecurity
- https://github.com/bakery312/Vulhub-Reproduce
- https://github.com/bkhablenko/CVE-2017-8046
- https://github.com/cved-sources/cve-2018-1273
- https://github.com/developer3000S/PoC-in-GitHub
- https://github.com/hectorgie/PoC-in-GitHub
- https://github.com/hktalent/bug-bounty
- https://github.com/huimzjty/vulwiki
- https://github.com/ilmari666/cybsec
- https://github.com/ilmila/J2EEScan
- https://github.com/j5s/HacLang
- https://github.com/j5s/HacLang-1
- https://github.com/jas502n/cve-2018-1273
- https://github.com/jiangsir404/POC-S
- https://github.com/just0rg/Security-Interview
- https://github.com/knqyf263/CVE-2018-1273
- https://github.com/langu-xyz/JavaVulnMap
- https://github.com/lnick2023/nicenice
- https://github.com/merlinepedra/nuclei-templates
- https://github.com/merlinepedra25/nuclei-templates
- https://github.com/nBp1Ng/FrameworkAndComponentVulnerabilities
- https://github.com/nBp1Ng/SpringFramework-Vul
- https://github.com/qazbnm456/awesome-cve-poc
- https://github.com/ronoski/j2ee-rscan
- https://github.com/seal-community/patches
- https://github.com/snowlovely/HacLang
- https://github.com/sobinge/nuclei-templates
- https://github.com/sspsec/Scan-Spring-GO
- https://github.com/sule01u/SBSCAN
- https://github.com/superlink996/chunqiuyunjingbachang
- https://github.com/tomoyamachi/gocarts
- https://github.com/wearearima/poc-cve-2018-1273
- https://github.com/webr0ck/poc-cve-2018-1273
- https://github.com/whoadmin/pocs
- https://github.com/xbl3/awesome-cve-poc_qazbnm456
- https://github.com/zhengjim/loophole
- https://github.com/zisigui123123s/FINAL