CVE-2021-42192

HIGH NUCLEI LAB

konga 0.14.9 - Incorrect Authorization

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-42192. PoCs published by Fabricio Salomao. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates a privilege escalation vulnerability in KONGA 0.14.9 by modifying a normal user's admin status to true via an API request. It authenticates with valid credentials and sends a PUT request to elevate privileges.

Description

Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.

Exploits (1)

exploitdb WORKING POC

by Fabricio Salomao · pythonwebappsmultiple

https://www.exploit-db.com/exploits/50521

View Code ZIP pw:eip

This exploit demonstrates a privilege escalation vulnerability in KONGA 0.14.9 by modifying a normal user's admin status to true via an API request. It authenticates with valid credentials and sends a PUT request to elevate privileges.

Classification

Working Poc 95%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: KONGA 0.14.9

Auth required

Prerequisites: Valid user credentials · Access to the KONGA API endpoint

MITRE ATT&CK