CVE-2022-21705 PoC — Octobercms 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21705.yaml

Associated Vulnerability

Title:Octobercms 安全漏洞 (CVE-2022-21705)
Description:Octobercms是美国Octobercms公司的一个基于Php的Cms建站系统。 Octobercms 存在安全漏洞，该漏洞源于用户输入在呈现前没有被正确地清除。拥有创建、修改和删除网站页面权限的认证用户可以利用这个漏洞绕过cms以便执行任意代码。

Description

October CMS is susceptible to remote code execution. In affected versions, user input is not properly sanitized before rendering. An authenticated user with the permissions to create, modify, and delete website pages can bypass cms.safe_mode and cms.enableSafeMode in order to execute arbitrary code. This affects admin panels that rely on safe mode and restricted permissions.

File Snapshot


 id: CVE-2022-21705

info:
  name: October CMS -  Remote Code Execution
  author: iPhantasmic
  sever

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!