CVE-2010-1622 PoC — Spring Framework 代码注入漏洞

Source

https://github.com/E-bounce/cve-2010-1622_learning_environment

Associated Vulnerability

Title:Spring Framework 代码注入漏洞 (CVE-2010-1622)
Description:SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

Description

cve-2010-1622 Learning Environment

Readme

# cve-2010-1622_learning_environment
- tomcat 6.0.26
- Jdk1.8.45
This Project Include simple SpringMvc source code and a Dockerfile you can use to build the environment.

File Snapshot


 [4.0K]  /data/pocs/b6d4a7777e15da194982011a450c5a5691b5629b
├── [ 122]  docker-compose.yml
├── [ 858]  Dockerfile
├── [1.8K]  pom.xml
├── [ 171]  README.md
├── [ 17K]  sp-exp.jar
└── [4.0K]  src
    └── [4.0K]  main
        ├── [4.0K]  java
        │   └── [4.0K]  com
        │       └── [4.0K]  ebounce
        │           └── [4.0K]  cn
        │               └── [4.0K]  cve10
        │                   ├── [4.0K]  controller
        │                   │   ├── [ 553]  InvokeFalseController.java
        │                   │   ├── [ 491]  invokeTrueController.java
        │                   │   ├── [ 711]  PrintURLsController.java
        │                   │   └── [ 654]  TController.java
        │                   └── [4.0K]  model
        │                       ├── [ 245]  OutPrint.java
        │                       ├── [ 497]  UserInfo.java
        │                       └── [ 140]  User.java
        ├── [4.0K]  resources
        │   └── [ 957]  cve10.xml
        └── [4.0K]  webapp
            └── [4.0K]  WEB-INF
                ├── [4.0K]  jsp
                │   ├── [ 547]  index.jsp
                │   ├── [ 221]  invoke_false.jsp
                │   ├── [ 217]  invoke_true.jsp
                │   └── [ 353]  test.jsp
                └── [ 812]  web.xml

13 directories, 18 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!