CVE-2019-25137 PoC — Umbraco 安全漏洞

Source

https://github.com/dact91/CVE-2019-25137-RCE

Associated Vulnerability

Title: Umbraco 安全漏洞 (CVE-2019-25137)
Description:Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx.

Description

CVE-2019-25137 is an Umbraco RCE vulnerability, the script within this repo is slightly altered

Readme

# CVE-2019-25137-RCE
CVE-2019-25137 is an Umbraco RCE vulnerability, the script within this repo is slightly altered

This exploit script is based on script by [Alexandre ZANNI](https://github.com/noraj) [EDB-ID 49488](https://www.exploit-db.com/exploits/49488).
It is slightly altered, changed the flow to skip token extraction before login, performed the login first (without a token), then captured the real CSRF token from the login response cookies.

⚠️ **Disclaimer:** This exploit code is provided **for educational and research purposes only**. Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical. Use responsibly.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →