X-SpringBoot through 6.0 Authentication Bypass via Static Master Code
48Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 9.3epss 0.3%
probabilidad de explotación
0.3%top 79% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
yzcheng90 · X-SpringBootPoCs públicas encontradas — 1
cve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/02_sms-code-account-takeover.pyno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/02_sms-code-account-takeover.pyhttps://github.com/yzcheng90/X-SpringBoothttps://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/doc/x_springboot.sql#L147https://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/sys/controller/SysLoginController.java#L94-L112https://www.vulncheck.com/advisories/x-springboot-through-6.0-authentication-bypass-via-static-master-code