CVE-2024-8190

This PoC exploits an authenticated command injection vulnerability in Ivanti Cloud Service Appliance by injecting a command into the TIMEZONE parameter of a POST request to /gsb/datetime.php. It requires valid credentials and a CSRF token.

This PoC combines CVE-2024-8963 (path traversal) and CVE-2024-8190 (command injection) to achieve unauthenticated RCE on Ivanti CSA 4.6 and below. It bypasses authentication via path manipulation and injects commands into the TIMEZONE parameter.