CVE-2021-42192 PoC — KONGA 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42192.yaml

Associated Vulnerability

Title:KONGA 安全漏洞 (CVE-2021-42192)
Description:KONGA是荷兰Panagis Tselentis个人开发者的一个功能齐全的开源、多用户 GUI。 KONGA v0.14.9 版本存在安全漏洞，该漏洞源于不正确的访问控制。攻击者利用此漏洞可通过特制请求提升权限。

Description

KONGA 0.14.9 allows attackers to set higher privilege users to full administration access. The attack vector is a crafted condition, as demonstrated by the /api/user/{ID} at ADMIN parameter.

File Snapshot


 id: CVE-2021-42192

info:
  name: KONGA 0.14.9 - Privilege Escalation
  author: rschio
  severity: h

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!