## https://sploitus.com/exploit?id=A21E1EBB-9E6E-57D9-B63F-C9370C5AC05C
PoC exploit for CVE-2020-13942, an unauthenticated RCE vulnerability through MVEL and OGNL injection in Apache Unomi. The exploit targets the context.js/json endpoint exposed by the Unomi server, allowing an attacker to execute arbitrary OS commands. Two RCE vectors are available: MVEL injection and OGNL injection, both of which bypass the fix introduced in Unomi version 1.5.1. To exploit the vulnerability, an attacker can send a specially crafted HTTP request using BurpSuite or curl, changing the Host and Content-length to match the target URL and OS command. The MVEL POC involves sending a POST request with a JSON payload containing a script that executes the gnome-calculator command.