CVE-2023-0297

This exploit leverages a pre-authentication RCE vulnerability in PyLoad 0.5.0 by sending a crafted POST request to the '/flash/addcrypted2' endpoint, injecting a Python command via the 'jk' parameter that executes arbitrary shell commands. The payload bypasses authentication and directly triggers command execution on the target system.

CVE-2023-0297 is a pre-authentication remote code execution (RCE) vulnerability in pyLoad versions prior to 0.5.0b3.dev31. The exploit abuses the `js2py` library's `pyimport` functionality to execute arbitrary Python code via JavaScript injection in the `jk` parameter of a POST request to `/flash/addcrypted2`.

This is a functional exploit for CVE-2023-0297, targeting an unauthenticated RCE vulnerability in PyLoad versions prior to 0.5.0b3.dev31. The exploit leverages a command injection flaw in the `flash/addcrypted2` endpoint to execute arbitrary commands, including reverse shells.

This PoC exploits CVE-2023-0297, a code injection vulnerability in pyLoad versions prior to 0.5.0b3.dev31, allowing pre-authentication RCE via js2py functionality. It sends a crafted POST request to '/flash/addcrypted2' and verifies vulnerability by checking DNS logs for a callback.

This is a functional exploit for CVE-2023-0297, which leverages a command injection vulnerability in the target software. The script sends a malicious POST request to execute a reverse shell via a crafted payload.

This Python script exploits CVE-2023-0297, a remote code execution vulnerability in pyload versions prior to 0.5.0b3.dev31. It sends a crafted POST request to the target's /flash/addcrypted2 endpoint, injecting a command via the 'jk' parameter.

This repository contains a functional exploit for CVE-2023-0297, an unauthenticated remote code execution vulnerability in PyLoad versions prior to 0.5.0b3.dev31. The exploit leverages a crafted payload sent to the '/flash/addcrypted2' endpoint to execute arbitrary commands on the target system.

This Metasploit module exploits CVE-2023-0297, a Python code injection vulnerability in pyLoad versions prior to 0.5.0b3.dev31. It leverages the js2py library's pyimport functionality via a crafted POST request to the flash/addcrypted2 endpoint, allowing unauthenticated remote code execution.