关联漏洞
标题：
strapi 授权问题漏洞
(CVE-2019-18818)
描述：strapi是一套开源的无头内容管理系统（CMS）。 strapi 3.0.0-beta.17.5之前版本中存在安全漏洞，该漏洞源于程序没有正确处理packages/strapi-admin/controllers/Auth.js和packages/strapi-plugin-users-permissions/controllers/Auth.js文件中的密码重置。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
描述
This repository contains a Python script to exploit two vulnerabilities: CVE-2019-18818 and CVE-2019-19609.
介绍
# Exploits for CVE-2019-18818 and CVE-2019-19609
This repository contains a Python script to exploit two vulnerabilities: CVE-2019-18818 and CVE-2019-19609.
## CVE-2019-18818
This vulnerability allows an attacker to reset the password of an admin user in the Strapi CMS.
### Usage
1. Modify the `target` and `strapi_port` variables in the script to match the target Strapi instance.
2. Run the script to reset the admin password.
## CVE-2019-19609
This vulnerability allows an attacker to execute arbitrary commands on the server running Strapi CMS.
### Usage
1. Modify the `local_ip` and `local_port` variables in the script to match your local machine's IP and desired port for the reverse shell.
2. Ensure you have a netcat listener running on the specified port: `nc -lvnp <local_port>`.
3. Run the script to send the remote shell payload.
## Disclaimer
This script is intended for educational purposes only. Use it at your own risk. The author is not responsible for any damage caused by this script.
## Requirements
- Python 3
- `requests` library
- `pwntools` library
### Installation
```bash
pip install requests pwntools
```
文件快照
[4.0K] /data/pocs/cf67cc6adb8e0231166bcad24812c905a12dd60d
├── [1.5K] CVE-2019-18818_CVE-2019-19609.py
└── [1.1K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。