# Octobercms中的账号接管漏洞
## 漏洞概述
OctoberCMS 是基于 Laravel PHP 框架的 CMS 平台。在受影响版本中，攻击者可以通过重置账户密码并使用特制请求来访问账户。
## 影响版本
- october/system 包 < Build 472 和 v1.1.5
## 漏洞细节
攻击者可以请求账户密码重置，然后通过一个特别构造的请求获取账户访问权限。
## 漏洞影响
攻击者可能获取账户访问权限，导致账户安全受到威胁。此漏洞已在 Build 472 和 v1.1.5 中修复。
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | Proof Of Concept code for OctoberCMS Auth Bypass CVE-2021-32648 | https://github.com/Immersive-Labs-Sec/CVE-2021-32648 | POC详情 |
| 2 | Patch your code for October CMS Auth Bypass CVE-2021-32648 | https://github.com/daftspunk/CVE-2021-32648 | POC详情 |
| 3 | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/CVE-2021-32648.yaml | POC详情 |
| 4 | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32648.yaml | POC详情 |
暂无评论