Exploit for ofbiz-poc

kitploit · 2026-08-28

Description

DNSLOG-based POC and EXP for Apache OFBiz CVE-2020-9496 and CVE-2021-26295 mass verification.

Entry point

Parametertest · path

Pathwebtools/control/xmlrpc

Unsafe deserialization of XMLRPC arguments in webtools/xmlrpc endpoint leading to remote code execution

Affected Apache Ofbiz versions

Apache Ofbiz= 17.12.03

All known vulnerabilities by product

CVSS 6.1 for CVE-2020-9496

6.1

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:REQUIRED

Scope:CHANGED

Confidentiality:LOW

Integrity:LOW

Availability:NONE

EPSS Score

98.9%higher than 99.9% of all CVEs

Updated 2026-08-30

Exploit Details

Modified:2026-08-28 05:03

Last Seen:2026-08-28 12:45

Reporter:KitPloit

Tags

Apache OFBizCVE-2020-9496CVE-2021-26295DNSLOG verificationmass scanningproof of concept

Other exploits for CVE-2020-9496

2026-08-29 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

apache-ofbiz-CVE-2020-9496

2026-08-29 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

2026-08-25 KitPloitKITPLOIT

2026-08-25 KitPloitKITPLOIT

Exploit for Improper Restriction of XML External Entity Reference in Apache Solr

2021-08-16 CreamGITEE

Exploit Code

MARKDOWN10 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-YUANEURO-OFBIZ-POC
# ofbiz-poc

CVE-2020-9496 e CVE_2020_9496 utilizzano dnslog per la verifica batch di poc ed exp delle vulnerabilità

## OFBiz_CVE_2020_9496.py e OFBiz_CVE_2021_26295.py sono per la verifica di singole vulnerabilità

## ofbiz_poc.py è per la verifica batch di due vulnerabilità, salva i siti da verificare in batch in urls.txt

### Per la replica della vulnerabilità visita: https://yuaneuro.cn/archives/ofbiz.html