CVE-2021-44848 PoC — Cybele Software Thinfinity VirtualUI授权问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44848.yaml

Associated Vulnerability

Title:Cybele Software Thinfinity VirtualUI授权问题漏洞 (CVE-2021-44848)
Description:Cybele Software Thinfinity VirtualUI是美国Cybele Software公司的一款支持将远程Windows应用程序嵌入到标准Web应用程序中，从而可以与Javascript编程进行双向交互的解决方案。 Cybele Software Thinfinity VirtualUI存在安全漏洞，该漏洞源于在 3.0 版本之前的 Cibele Thinfinity VirtualUI 中，/changePassword 根据用户名是否存在，对无效的认证请求返回不同的响应。

Description

Thinfinity VirtualUI (before v3.0), /changePassword returns different responses for requests depending on whether the username exists. It may enumerate OS users (Administrator, Guest, etc.)

File Snapshot


 id: CVE-2021-44848

info:
  name: Thinfinity VirtualUI User Enumeration
  author: danielmofer
  seve

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!