CVE-2023-2375 PoC — Ubiquiti EdgeRouter X Web Management command injection

Source

https://github.com/0x0jr/HTB-Devvortex-CVE-2023-2375-PoC

Associated Vulnerability

Title: Ubiquiti EdgeRouter X Web Management command injection (CVE-2023-2375)
Description:A weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. Impacted is an unknown function of the component Web Management Interface. Executing a manipulation of the argument src can lead to command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The presence of this vulnerability remains uncertain at this time. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

Description

CVE-2023-23752 Unauthenticated Information Disclosure Showcase Using Devvortex From HTB.

Readme

# Joomla! CVE-2023-23752 - Unauthenticated Information Disclosure PoC

## Description

This repository contains a Proof of Concept (PoC) exploit for CVE-2023-23752, a vulnerability in Joomla! that allows unauthenticated information disclosure. This vulnerability can expose sensitive information, including database credentials, configuration files, and more, to unauthenticated users.

## PoC

You can watch my PoC on this CVE here:

https://www.youtube.com/watch?v=vf_d0AWd7T8

## Details

- **CVE:** CVE-2023-23752
- **Vulnerability Type:** Information Disclosure
- **Affected Version:** Joomla! 4.2.8

## Usage

1. **Clone the repository:**
    ```
    git clone https://github.com/0x0jr/HTB-Devvortex-CVE-2023-2375-PoC.git
    ```

2. **Install dependencies:**
    ```
    pip install requests
    ```

3. **Run the PoC:**
    ```
    python3 exploit.py <target_url>
    ```

    Replace `<target_url>` with the URL of the target Joomla! instance.

## Example

```
python3 exploit.py http://dev.devvortex.htb/
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →