CVE-2022-28117 PoC — Navigate CMS 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28117.yaml

Associated Vulnerability

Title:Navigate CMS 代码问题漏洞 (CVE-2022-28117)
Description:Naviwebs Navigate CMS是美国Naviwebs公司的一套开源的内容管理系统（CMS）。 Navigate CMS v2.9.4存在安全漏洞，该漏洞允许远程攻击者通过将任意 URL 注入到 feed 参数中来强制应用程序发出任意请求。

Description

Navigate CMS 2.9.4 is susceptible to server-side request forgery via feed_parser class. This can allow a remote attacker to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter, thus enabling possible theft of sensitive information, data modification, and/or unauthorized operation execution.

File Snapshot


 id: CVE-2022-28117

info:
  name: Navigate CMS 2.9.4 - Server-Side Request Forgery
  author: theabhi

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!