CVE-2024-48322 PoC — run.codes 安全漏洞

Source

https://github.com/trqt/CVE-2024-48322

Associated Vulnerability

Title:run.codes 安全漏洞 (CVE-2024-48322)
Description:UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.

Readme

# CVE-2024-48322

You need to have an account in the RunCodes instance, any privilege.
Install with poetry and run providing the base url of the instance.

```sh
$ python pay.py <...>
```

Look at your email inbox, the password should be there.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →