CVE-2023-43364 PoC — Searchor 安全漏洞

Source

https://github.com/libertycityhacker/CVE-2023-43364-Exploit-CVE

Associated Vulnerability

Title:Searchor 安全漏洞 (CVE-2023-43364)
Description:Searchor是Arjun Sharda个人开发者的一款一体化 PyPi Python 库。可简化网页抓取、获取主题信息以及生成搜索查询 URL。 Searchor 2.4.2之前版本存在安全漏洞，该漏洞源于文件main.py存在代码执行漏洞。

Readme

# CVE-2023-43364-Exploit-CVE
This is a python script to exploit Searchor 2.4.0 - the eval() function was implemented insecurely and can be exploited for RCE.

This machine relies on busybox being installed, as I wrote this for the Busqueda machine on HackTheBox. Just replace the payload with another reverse shell if you need to use something other than busybox.

File Snapshot


 [4.0K]  /data/pocs/b834bfb09013d25078f4612713152406910daad3
├── [ 968]  exploit.py
└── [ 364]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!