CVE-2024-2997
LOWBdtask Multi-Store Inventory Management System <20240320 - XSS
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2024-2997. PoCs published by lfillaz, NullEssa, lfilharv.
AI-analyzed exploit summary The repository contains a Python script designed to scan for CVE-2024-2997, a command injection vulnerability. It sends multiple payloads to detect indicators of successful exploitation but does not include functional exploit code to achieve RCE.
Description
A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument Category Name/Model Name/Brand Name/Unit Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258199. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Exploits (5)
The repository contains a Python script designed to scan for CVE-2024-2997, a command injection vulnerability. It sends multiple payloads to detect indicators of successful exploitation but does not include functional exploit code to achieve RCE.
The repository contains a Python script designed to scan for CVE-2024-2997 by sending crafted HTTP requests with payloads targeting command injection vulnerabilities. It checks responses for indicators of successful exploitation but does not include functionality to execute arbitrary commands or achieve remote code execution.
This repository contains a functional exploit PoC for CVE-2024-2997, targeting a command injection vulnerability in the `/cmd,/simZysh/register_main/setCookie` endpoint. The script sends crafted payloads to execute commands like `id` and `whoami`, and checks for indicators of successful exploitation in the response.
The repository contains a Python script designed to scan for CVE-2024-2997 by sending crafted HTTP requests to target URLs and checking for indicators of command injection vulnerability. It includes multiple payloads and response analysis but does not demonstrate actual exploitation.
The repository contains a Python script designed to scan for CVE-2024-2997 by sending crafted HTTP requests with payloads targeting command injection vulnerabilities. It checks responses for indicators of successful exploitation but does not include functional exploit code for achieving RCE.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N