## https://sploitus.com/exploit?id=C777308B-3367-5B79-80BD-9AE02EAF8EA0
# CVE-2020-9496
## Set-up Vulnerable Environment
```bash
â–¶ wget http://archive.apache.org/dist/ofbiz/apache-ofbiz-17.12.01.zip
â–¶ unzip apache-ofbiz-17.12.01.zip
â–¶ cd apache-ofbiz-17.12.01
â–¶ sh gradle/init-gradle-wrapper.sh
â–¶ ./gradlew cleanAll loadDefault
â–¶ ./gradlew "ofbiz --load-data readers=seed,seed-initial,ext"
â–¶ ./gradlew ofbiz # Start OFBiz
```
Open a browser and go to `https://localhost:8443`.
The default administrative account is username: **admin** password: **ofbiz**.
## Proof of Concept
### Using [nuclei](https://github.com/projectdiscovery/nuclei)
- https://github.com/projectdiscovery/nuclei-templates/pull/312
```
> echo "https://localhost:8443" | nuclei -t cves/CVE-2020-9496.yaml
```