POC详情： 571aa478c0ccf504b8abc9cb318047c35f594e7e

来源
https://github.com/Cappricio-Securities/CVE-2022-21371
关联漏洞
标题： Oracle WebLogic Server 路径遍历漏洞 (CVE-2022-21371)
描述：Oracle WebLogic Server是美国甲骨文（Oracle）公司的一款适用于云环境和传统环境的应用服务中间件，它提供了一个现代轻型开发平台，支持应用从开发到生产的整个生命周期管理，并简化了应用的部署和管理。 Oracle WebLogic Server存在路径遍历漏洞，该漏洞源于Web Container组件中不正确的输入验证。攻击者可利用该漏洞访问敏感信息。
描述
Oracle WebLogic Server (LFI)
介绍
<div align="center">
  <img src="https://blogs.cappriciosec.com/uploaders/CVE-2022-21371-tool.png" alt="logo">
</div>


## Badges



[![MIT License](https://img.shields.io/badge/License-MIT-green.svg)](https://choosealicense.com/licenses/mit/)
![PyPI - Version](https://img.shields.io/pypi/v/CVE-2022-21371)
![PyPI - Downloads](https://img.shields.io/pypi/dm/CVE-2022-21371)
![GitHub all releases](https://img.shields.io/github/downloads/Cappricio-Securities/CVE-2022-21371/total)
<a href="https://github.com/Cappricio-Securities/CVE-2023-27524/releases/"><img src="https://img.shields.io/github/release/Cappricio-Securities/CVE-2022-21371"></a>![Profile_view](https://komarev.com/ghpvc/?username=Cappricio-Securities&label=Profile%20views&color=0e75b6&style=flat)
[![Follow Twitter](https://img.shields.io/twitter/follow/cappricio_sec?style=social)](https://twitter.com/cappricio_sec)
<p align="center">

<p align="center">







## License

[MIT](https://choosealicense.com/licenses/mit/)



## Installation 

1. Install Python3 and pip [Instructions Here](https://www.python.org/downloads/) (If you can't figure this out, you shouldn't really be using this)

   - Install via pip
     - ```bash
          pip install CVE-2022-21371 
        ```
   - Run bellow command to check
     - `CVE-2022-21371 -h`

## Configurations 
2. We integrated with the Telegram API to receive instant notifications for vulnerability detection.
   
   - Telegram Notification
     - ```bash
          CVE-2022-21371 --chatid <YourTelegramChatID>
        ```
   - Open your telegram and search for [`@CappricioSecuritiesTools_bot`](https://web.telegram.org/k/#@CappricioSecuritiesTools_bot) and click start

## Usages 
3. This tool has multiple use cases.
   
   - To Check Single URL
     - ```bash
          CVE-2022-21371 -u http://example.com 
        ```
   - To Check List of URL 
      - ```bash
          CVE-2022-21371 -i urls.txt 
        ```
   - Save output into TXT file
      - ```bash
          CVE-2022-21371 -i urls.txt -o out.txt
        ```
   - Want to Learn about [`CVE-2022-21371`](https://blogs.cappriciosec.com/cve/189/CVE-2022-21371%20-%20A%20Critical%20WebLogic%20Server%20Vulnerability)? Then Type Below command
      - ```bash
          CVE-2022-21371 -b
        ```
     
<p align="center">
  <b>🚨 Disclaimer</b>
  
</p>
<p align="center">
<b>This tool is created for security bug identification and assistance; Cappricio Securities is not liable for any illegal use. 
  Use responsibly within legal and ethical boundaries. 🔐🛡️</b></p>

  ## Working PoC Video

[![asciicast](https://blogs.cappriciosec.com/uploaders/Screenshot%202024-06-17%20at%203.23.53%20PM.png)](https://asciinema.org/a/cgrBfXuAhFd85qBQNd1V9FdEN)



## Help menu

#### Get all items

```bash
👋 Hey Hacker  
                                                                      
       v1.0
   _______    ________    ___   ____ ___  ___       ___  ________________
  / ____/ |  / / ____/   |__ \ / __ \__ \|__ \     |__ \<  /__  /__  <  /
 / /    | | / / __/________/ // / / /_/ /__/ /_______/ // / /_ <  / // /
/ /___  | |/ / /__/_____/ __// /_/ / __// __/_____/ __// /___/ / / // /
\____/  |___/_____/    /____/\____/____/____/    /____/_//____/ /_//_/

                              Developed By https://cappriciosec.com   

Usage: CVE-2022-21371 [options]

Options:
  -u, --url     URL to scan                                CVE-2022-21

Usage: CVE-2022-21371 [options]

Options:
  -u, --url     URL to scan                                CVE-2022-21371 -u https://target.com
  -i, --input   <filename> Read input from txt             CVE-2022-21371 -i target.txt
  -o, --output  <filename> Write output in txt file        CVE-2022-21371 -i target.txt -o output.txt
  -c, --chatid  Creating Telegram Notification             CVE-2022-21371 --chatid yourid
  -b, --blog    To Read about CVE-2022-21371 Bug           CVE-2022-21371 -b
  -h, --help    Help Menu
```


| Argument | Type     | Description                | Examples |
| :-------- | :------- | :------------------------- | :------------------------- |
| `-u` | `--url` | URL to scan | CVE-2022-21371 -u https://target.com |
| `-i` | `--input` | filename Read input from txt  | CVE-2022-21371 -i target.txt | 
| `-o` | `--output` | filename Write output in txt file | CVE-2022-21371 -i target.txt -o output.txt |
| `-c` | `--chatid` | Creating Telegram Notification | CVE-2022-21371 --chatid yourid |
| `-b` | `--blog` | To Read about CVE-2022-21371 Bug | CVE-2022-21371 -b |
| `-h` | `--help` | Help Menu | CVE-2022-21371 -h |



## 🔗 Links
[![Website](https://img.shields.io/badge/my_portfolio-000?style=for-the-badge&logo=ko-fi&logoColor=white)](https://cappriciosec.com/)
[![linkedin](https://img.shields.io/badge/linkedin-0A66C2?style=for-the-badge&logo=linkedin&logoColor=white)](https://www.linkedin.com/in/karthikeyan--v/)
[![twitter](https://img.shields.io/badge/twitter-1DA1F2?style=for-the-badge&logo=twitter&logoColor=white)](https://twitter.com/karthithehacker)



## Author

- [@karthithehacker](https://github.com/karthi-the-hacker/)



## Feedback

If you have any feedback, please reach out to us at contact@karthithehacker.com
文件快照

 [4.0K]  /data/pocs/571aa478c0ccf504b8abc9cb318047c35f594e7e
├── [4.0K]  cve202221371
│   ├── [4.0K]  includes
│   │   ├── [ 650]  bot.py
│   │   ├── [ 470]  filereader.py
│   │   ├── [   0]  __init__.py
│   │   ├── [2.3K]  scan.py
│   │   └── [ 285]  writefile.py
│   ├── [1.7K]  main.py
│   └── [4.0K]  utils
│       ├── [1.9K]  configure.py
│       ├── [ 868]  const.py
│       ├── [2.3K]  helpers.py
│       ├── [   0]  __init__.py
│       └── [ 227]  status.py
├── [1.0K]  LICENSE
├── [5.1K]  README.md
└── [1.0K]  setup.py

3 directories, 14 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。