CVE-2019-9874 PoC — Sitecore和Sitecore XP 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9874.yaml

Associated Vulnerability

Title:Sitecore和Sitecore XP 代码问题漏洞 (CVE-2019-9874)
Description:Sitecore和Sitecore XP都是丹麦Sitecore公司的产品。Sitecore是一套在线营销内容管理系统（CMS）。该系统支持内容编辑、多种语言、多网站部署、数字资产管理等。Sitecore XP是一套客户数字体验平台。 Sitecore 7.0版本至7.2版本和Sitecore XP 7.5版本至8.2版本中的Sitecore.Security.AntiCSRF模块存在代码问题漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。

Description

Sitecore Experience Platform before 8.2 Update-7 and 9.0 before Update-2 is vulnerable to a remote code execution vulnerability (CVE-2019-9874). An attacker can exploit this issue to execute arbitrary code on the affected system via a crafted request to the /sitecore/shell/Applications/Layouts/IDE.aspx endpoint.

File Snapshot


 id: CVE-2019-9874

info:
  name: Sitecore Experience Platform - Deserialization of Untrusted Data
  

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!