cve/2012/CVE-2012-0394.md

CVE-2012-0394

Description

** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."

POC

Reference

• http://www.exploit-db.com/exploits/18329
• http://www.exploit-db.com/exploits/31434

Github

• https://github.com/20142995/pocsuite3
• https://github.com/ARPSyndicate/kenzer-templates