Exploit for CVE-2023-49070

kitploit · 2026-08-26

Description

Pre-auth RCE in Apache OFBiz allowing unauthenticated remote code execution.

Entry point

ParameterUSERNAME · query param

Path/webtools/control/xmlrpc

Pre-auth RCE in OFBiz via XML-RPC endpoint exposure (POC uses query parameters).

Affected Apache Ofbiz versions

Apache Ofbiz< 18.12.10

All known vulnerabilities by product

CVSS 9.8 for CVE-2023-49070

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

95.4%higher than 99.9% of all CVEs

Updated 2026-08-30

CVE Information

References

https://github.com/0xrobiul/CVE-2023-49070

Exploit Details

Modified:2026-08-26 07:35

Last Seen:2026-08-26 10:07

Reporter:KitPloit

Tags

Apache OFBizRemote Code ExecutionPre-authenticationUnauthenticated Access

Other exploits for CVE-2023-49070

ofbiz-CVE-2023-49070-RCE-POC

2026-08-30 KitPloitKITPLOIT

Apache-OFBiz-Authentication-Bypass

2026-08-29 KitPloitKITPLOIT

Exploit-CVE-2023-49070-and-CVE-2023-51467-Apache-OFBiz

2026-08-29 KitPloitKITPLOIT

Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

CVE-2023-49070_CVE-2023-51467

2026-08-26 KitPloitKITPLOIT

Exploit for Code Injection in Apache Ofbiz

2024-01-17 Praison001GITHUB

Exploit for Server-Side Request Forgery in Apache Ofbiz

2024-01-13 Jake123otte1GITHUB

Exploit Code

MARKDOWN11 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-0XROBIUL-CVE-2023-49070
#  CVE-2023-49070   


#### RCE pre-autenticazione in Apache Ofbiz!!

![](https://img.shields.io/static/v1?label=Project&message=CVE-2023-49070&color=green) ![](https://img.shields.io/twitter/follow/0xrobiul?style=social) ![](https://img.shields.io/youtube/views/gDzYb6YvBSQ?style=social) ![](https://img.shields.io/static/v1?label=Version&message=1.0&color=green)

# 

Guarda il video POC: https://youtu.be/gDzYb6YvBSQ