CVE-2020-15227
HIGH EXPLOITED NUCLEINette <2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 - Code Injection
Title source: llmExploitation Summary
CVE-2020-15227 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including hu4wufu, filipsedivy, Langriklol. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit targets CVE-2020-15227, a code injection vulnerability in Nette Framework's `nette.micro` component. It achieves RCE by injecting a reverse shell command via the `callback` parameter, establishing a TCP connection back to the attacker.
Description
Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
Exploits (3)
This exploit targets CVE-2020-15227, a code injection vulnerability in Nette Framework's `nette.micro` component. It achieves RCE by injecting a reverse shell command via the `callback` parameter, establishing a TCP connection back to the attacker.
This repository contains a Python-based proof-of-concept exploit for CVE-2020-15227, which targets a potential remote code execution vulnerability in Nette Framework applications. The exploit tests for vulnerabilities in file writing functions and shell execution by generating unique checksums and verifying their presence in server responses.
This repository contains a functional exploit and autofixer for CVE-2020-15227, a code injection vulnerability in Nette Framework's nette.micro component. The exploit achieves RCE via a reverse shell, while the autofixer attempts to patch the vulnerability by updating Composer dependencies.
Nuclei Templates (1)
app="nette-Framework" || app="nette-framework"
References (4)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N