CVE-2024-11680

The repository contains functional exploit code for CVE-2024-11680, specifically targeting Altenergy with a SQL injection vulnerability. The script sends a crafted payload to the '/index.php/display/status_zigbee' endpoint and checks for a specific response pattern to confirm exploitation.

This repository contains a functional PoC exploit for CVE-2024-11680, targeting an improper authentication flaw in ProjectSend r1605 and older versions. The exploit demonstrates privilege misconfiguration by modifying the application title, enabling insecure options, and registering a new user.

This repository contains a functional Python exploit for CVE-2024-11680, targeting ProjectSend. The exploit chains CSRF token bypass, insecure client registration, and unrestricted file upload to achieve unauthenticated remote code execution via a PHP web shell.

This Metasploit module exploits an improper authorization vulnerability in ProjectSend (r1295-r1605) to achieve unauthenticated remote code execution by enabling user registration, disabling file extension restrictions, and uploading a malicious PHP file.