Exploit for Code Injection in Apache Ofbiz

githubexploit · 2023-12-17

Description

Exploit for Apache Ofbiz Code Injection CVE-2023-49070 Pre-auth RC

Entry point

ParameterUSERNAME · query param

Path/webtools/control/xmlrpc

Pre-auth RCE in OFBiz via XML-RPC endpoint exposure (POC uses query parameters).

Affected Apache Ofbiz versions

Apache Ofbiz< 18.12.10

All known vulnerabilities by product

CVSS 9.8 for CVE-2023-49070

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

100%confidence this exploit runs

Based on 3 file(s) in the source

EPSS Score

95.4%higher than 99.9% of all CVEs

Updated 2026-08-29

Exploit Details

Modified:2025-04-22 04:24

Last Seen:2025-08-31 21:49

Reporter:0xrobiul

Written in:Python

Last commit:2023-12-26

Tags

apache ofbizcode injectionCVE-2023-49070pre-auth rceopen jdk 11poc videosecurity vulnerability

Other exploits for CVE-2023-49070

ofbiz-CVE-2023-49070-RCE-POC

2026-08-29 KitPloitKITPLOIT

Apache-OFBiz-Authentication-Bypass

2026-08-29 KitPloitKITPLOIT

Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

Exploit-CVE-2023-49070-and-CVE-2023-51467-Apache-OFBiz

2026-08-28 KitPloitKITPLOIT

CVE-2023-49070_CVE-2023-51467

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

Exploit for Code Injection in Apache Ofbiz

2024-01-17 Praison001GITHUB

Exploit Code

README37 lines

## https://sploitus.com/exploit?id=37882A72-8CE6-5A9B-9A6B-EB3F8504A1D3
CVE-2023-49070
  

Pre-auth RCE in Apache Ofbiz!!
    
  
    
  
  
      
  
  
      
  
  
    
  


  
  
  
  

Usagse
Install Open JDK 11 First!

sudo apt install openjdk-11-jdk


  
  
  
  

Check POC Video: https://youtu.be/gDzYb6YvBSQ