CVE-2022-24637 PoC — Open Web Analytics Server 安全漏洞

Source

https://github.com/0xM4hm0ud/CVE-2022-24637

Associated Vulnerability

Title:Open Web Analytics Server 安全漏洞 (CVE-2022-24637)
Description:Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.

Description

Unauthenticated RCE in Open Web Analytics version <1.7.4

Readme

# CVE-2022-24637
Unauthenticated RCE in Open Web Analytics version &lt;1.7.4

This script is made to automate the CVE-2022-24637 vulnerability. I created this exploit for my Hackthebox machine vessel. https://app.hackthebox.com/machines/Vessel

The exploit and idea is based on https://devel0pment.de/?p=2494


## exploit

Run the script with the following parameters:

`python3 exploit.py http://<url>/ newPassword YourIp YourPort`

It might be possible that you need to run it a few times to get a shell.

The script can be improved.

![img](exploit.jpg)

File Snapshot


 [4.0K]  /data/pocs/0758312f196fa9da004c91253e14dcbbe866a066
├── [4.3K]  CVE-2022-24637.py
├── [132K]  exploit.jpg
└── [ 557]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!