CVE-2019-5475

This PoC exploits CVE-2019-5475 in Nexus Repository Manager by sending a malicious PUT request to the capabilities endpoint, injecting a reverse shell payload via the 'createrepoPath' property. The payload attempts to establish a reverse shell connection to 127.0.0.1 on port 6666.

This repository contains a proof-of-concept exploit for CVE-2019-5475 and CVE-2019-15588, which are command injection vulnerabilities in Nexus Repository Manager's Yum plugin. The PoC demonstrates remote code execution (RCE) via command injection in the 'createrepo' and 'mergerepo' path fields.

This PoC exploits CVE-2019-5475, a remote command execution vulnerability in Nexus Repository Manager 2.x. It leverages the 'mergerepo' configuration to inject and execute arbitrary commands via a crafted JSON payload.

This repository provides a functional exploit PoC for CVE-2019-5475, a command injection vulnerability in Nexus Repository Manager's Yum plugin. It includes Docker-based environments for both CVE-2019-5475 and CVE-2019-15588, along with Java code to simulate the vulnerability and payloads for RCE.