CVE-2024-40324 PoC — E-Staff 安全漏洞

Source

Associated Vulnerability

Readme

# CVE-2024-40324

## Description

A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fields, leading to HTTP response splitting and header manipulation.

## Vulnerability Type

CRLF

## Vendor of Product

E-Staff

## Affected Product Code Base

E-Staff 5.1 

## Affected Component

HTTP headers

## Attack Type

Remote

## Impact Code execution

Potential for arbitrary header injection, cache poisoning, and session hijacking, cross-site scripting (XSS),  and other exploits.

## Discoverer

- Aleksey Vistorobskiy

## Attack Vectors

An attacker can insert CRLF characters into input fields, manipulating HTTP headers. For example, injecting CRLF into HTTP headers can result in HTTP response splitting


Screenshot:
![](/1.png)

## Reference

- https://e-staff.ru/estaff_home
- https://github.com/aleksey-vi/CVE-2024-40324

File Snapshot

 [4.0K]  /data/pocs/d66f08b51a55f60b8924fa23a3f8ab602366b953
├── [ 99K]  1.png
└── [ 911]  README.md

0 directories, 2 files

Remarks