CVE-2024-40348 PoC — Bazarr 安全漏洞

Source

https://github.com/NingXin2002/Bazaar_poc

Associated Vulnerability

Title:Bazarr 安全漏洞 (CVE-2024-40348)
Description:Bazarr是Bazarr公司的一款软件，是 Sonarr 和 Radarr 的配套应用程序，可根据您的要求管理和下载字幕。 Bazarr v1.4.3版本存在安全漏洞，该漏洞源于允许未经身份验证的攻击者执行目录遍历。

Description

Bazaar v1.4.3 任意文件读取漏洞(CVE-2024-40348)

Readme

# Bazaar_poc
Bazaar v1.4.3 任意文件读取漏洞(CVE-2024-40348)

python Bazaar_poc.py -h  

                ) (`-.            ) (`-.
         ( OO ).           ( OO ).
        (_/.  \_)-. ,-.-')(_/.  \_)-. ,-.-')
         \  `.'  /  |  |OO)\  `.'  /  |  |OO)
          \     /\  |  |  \ \     /\  |  |  \
           \   \ |  |  |(_/  \   \ |  |  |(_/
          .'    \_),|  |_.' .'    \_),|  |_.'
         /  .'.  \(_|  |   /  .'.  \(_|  |
        '--'   '--' `--'  '--'   '--' `--'

usage: Bazaar_poc.py [-h] [-u URL] [-f FILE]  

Bazaar v1.4.3 任意文件读取漏洞(CVE-2024-40348)  

optional arguments:  
  -h, --help            show this help message and exit  
  -u URL, --url URL     添加url信息  
  -f FILE, --file FILE  添加txt文件  

example:  
    python3 Bazaar_poc.py -u http://xxxx.xxxx.xxxx.xxxx  
    python3 Bazaar_poc.py -f x_url.txt

File Snapshot


 [4.0K]  /data/pocs/9e07e7fae81e7536607d2ea1e69ead9b5ff4e8c9
├── [2.8K]  Bazaar_poc.py
└── [ 870]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!