跳转到帖子

BYOB Unauthenticated RCE via Arbitrary File Write and Command Injection (CVE-2024-45256, CVE-2024-45257)

recommended_posts

发布于
  • Members

BYOB Unauthenticated RCE via Arbitrary File Write and Command Injection (CVE-2024-45256, CVE-2024-45257)

Disclosed
08/15/2024
Created
10/15/2024

Description

This module exploits two vulnerabilities in the BYOB (Build Your Own Botnet) web GUI: 1. CVE-2024-45256: Unauthenticated arbitrary file write that allows modification of the SQLite database, adding a new admin user. 2. CVE-2024-45257: Authenticated command injection in the payload generation page. These vulnerabilities remain unpatched.

Author(s)

  • chebuya
  • Valentin Lobstein

Platform

Linux,Unix

Architectures

ARCH_CMD

Development

  • Source Code
  • History
  • 查看数 693
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…