目标达成 感谢每一位支持者 — 我们达成了 100% 目标!

目标: 1000 元 · 已筹: 1359 元

100%

CVE-2024-34470 PoC — HSC Cybersecurity HC Mailinspector 路径遍历漏洞

来源
关联漏洞
标题: HSC Cybersecurity HC Mailinspector 路径遍历漏洞 (CVE-2024-34470)
Description:HSC Cybersecurity HC Mailinspector是HSC Cybersecurity公司的一个云电子邮件安全解决方案。 HSC Cybersecurity HC Mailinspector 5.2.17-3 到 v.5.2.18版本存在路径遍历漏洞,该漏洞源于/public/loader.php 中存在未经身份验证的路径遍历漏洞,path 参数没有正确过滤传递的文件和目录是否是webroot的一部分,从而允许攻击者读取服务器上的任意文件。
Description
CVE-2024-34470 : An Unauthenticated Path Traversal Vulnerability in HSC Mailinspector
介绍
# CVE-2024-34470 : An Unauthenticated Path Traversal Vulnerability in HSC Mailinspector

CVEHunter tool for vulnerability detection and exploitation tool for CVE-2024-34470 with Asychronous Performance.

### Installation
```bash
git clone https://github.com/th3gokul/CVE-2024-34470.git
cd CVE-2024-34470
pip install -r requirements.txt
python3 cvehunter.py --help
```
### Usage
```bash
python3 cvehunter.py -h

  ____ __     __ _____  _   _                _               
 / ___|\ \   / /| ____|| | | | _   _  _ __  | |_   ___  _ __ 
| |     \ \ / / |  _|  | |_| || | | || '_ \ | __| / _ \| '__|
| |___   \ V /  | |___ |  _  || |_| || | | || |_ |  __/| |   
 \____|   \_/   |_____||_| |_| \__,_||_| |_| \__| \___||_| 
     CVE-2024-34470                      @th3gokul

[Description]: Vulnerability Detection and Exploitation
tool for CVE-2024-34470

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     [INF]: Specify a URL or domain
                        for vulnerability detection
  -l LIST, --list LIST  [INF]: Specify a list of URLs
                        for vulnerability detection
  -t THREADS, --threads THREADS
                        [INF]: Number of threads for
                        list of URLs
  -proxy PROXY, --proxy PROXY
                        [INF]: Proxy URL to send request
                        via your proxy
  -v, --verbose         [INF]: Increases verbosity of
                        output in console
  -o OUTPUT, --output OUTPUT
                        [INF]: Filename to save output
                        of vulnerable target]
```
### About
The tool is Developed by [th3Gokul](https://www.linkedin.com/in/gokul-v-13455521a/) to detect and exploit the Vulnerability Unauthenticated Path Traversal Vulnerability in HSC Mailinspector CVE-2024-34470
### Disclaimer
The tool is only for education and ethical purpose only and Developers are not responsible for any illegal exploitations.
文件快照

登录后查看神龙缓存的 POC 文件快照

登录查看
备注
    1. 建议优先通过来源进行访问。
    2. 本地 POC 快照面向订阅用户开放;当原始来源失效或无法访问时,本地镜像作为订阅权益的一部分提供。
    3. 持续抓取、验证、维护这份 POC 档案需要不少投入,因此本地快照已纳入付费订阅。您的订阅是让这份资料能继续走下去的关键,由衷感谢。 查看订阅方案 →