CVE-2024-51747 PoC — Kanboard 安全漏洞

介绍

# CVE-2024-51747
Log in with an administrator account and download the database in the system settings
![2024-11-15_114806](https://github.com/user-attachments/assets/05843939-b0eb-45b0-9c7a-e5fba955c9f4)

Modify project_has_files in the sqlite.db database
![2024-11-15_115438](https://github.com/user-attachments/assets/aa7f2fd1-464f-418e-a50b-84cb9935566b)

Compress the modified sqlite.db with gzip and upload it. After uploading it to the project and clicking the file to view/download, the attacker can read and delete any file from the server.
![2024-11-15_115652](https://github.com/user-attachments/assets/c04a30af-7140-4193-a527-21d7d2691df4)

文件快照

备注