Exploitation Summary
EIP tracks 2 public exploits for CVE-2021-3130. PoCs published by jet-pentest, lusterx.
AI-analyzed exploit summary The repository describes an insufficiently protected credentials vulnerability in Open-AudIT up to version 3.5.3, where SSH secrets, Windows passwords, and SNMP strings are obfuscated via HTML password fields but can be revealed using browser developer tools. The writeup provides a clear technical description of the issue and references the vendor.
Description
Within the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets, Windows passwords, and SNMP strings from users using HTML 'password field' obfuscation. By using Developer tools or similar, it is possible to change the obfuscation so that the credentials are visible.
Exploits (2)
The repository describes an insufficiently protected credentials vulnerability in Open-AudIT up to version 3.5.3, where SSH secrets, Windows passwords, and SNMP strings are obfuscated via HTML password fields but can be revealed using browser developer tools. The writeup provides a clear technical description of the issue and references the vendor.
This repository contains a functional exploit for CVE-2021-3129, an unauthenticated RCE vulnerability in Laravel <8.4.2 when debug mode is enabled. The exploit leverages deserialization via PHPGGC to achieve remote command execution.
References (2)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N