CVE-2023-0297

Related Files

PyLoad 0.5.0 Remote Code Execution

Posted Jun 15, 2023

Authored by Gabriel Lima

PyLoad version 0.5.0 suffers from an unauthenticated remote code execution vulnerability.

tags | exploit, remote, code execution

advisories | CVE-2023-0297

SHA-256 | 1da79fd53f155f771e35a92c59e86649cc8ac43c4895cbcb08f9ef8dad5414f0

Download | Favorite | View

pyLoad js2py Python Execution

Posted Feb 22, 2023

Authored by Spencer McIntyre, bAu | Site metasploit.com

pyLoad versions prior to 0.5.0b3.dev31 are vulnerable to Python code injection due to the pyimport functionality exposed through the js2py library. An unauthenticated attacker can issue a crafted POST request to the flash/addcrypted2 endpoint to leverage this for code execution. pyLoad by default runs two services, the primary of which is on port 8000 and can not be used by external hosts. A secondary Click N Load service runs on port 9666 and can be used remotely without authentication.

tags | exploit, code execution, python

advisories | CVE-2023-0297

SHA-256 | d86b89ccd29b81ac570725e1b71f96f42350980adb191ce14634207100bc2450

Download | Favorite | View