CVE-2024-1651
CRITICALTorrentpier 2.4.1 - Remote Code Execution via Insecure Deserialization
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2024-1651. PoCs published by sharpicx, hy011121, killukeren.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-1651, leveraging insecure object deserialization in a PHP-based forum software to achieve remote code execution (RCE). The exploit authenticates, crafts a malicious serialized payload using GuzzleHttp components, and uploads a PHP shell for command execution.
Description
Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization.
Exploits (4)
This repository contains a functional exploit for CVE-2024-1651, leveraging insecure object deserialization in a PHP-based forum software to achieve remote code execution (RCE). The exploit authenticates, crafts a malicious serialized payload using GuzzleHttp components, and uploads a PHP shell for command execution.
This repository contains a functional exploit for CVE-2024-1651, targeting Torrentpier v2.4.1. The exploit leverages unsafe deserialization to achieve remote code execution (RCE) by crafting a malicious serialized object and uploading a PHP shell.
This repository contains a functional exploit for CVE-2024-1651, leveraging PHP deserialization in a web application to achieve remote code execution (RCE). The exploit logs in with hardcoded credentials, crafts a malicious serialized payload, and uploads a PHP shell to a vulnerable endpoint.
This repository contains a functional exploit for CVE-2024-1651, leveraging insecure object deserialization in a PHP-based forum software to achieve remote code execution (RCE). The exploit authenticates, crafts a malicious serialized payload, and uploads a shell to execute arbitrary commands.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H