kairo-one/cve-2023-26469-joraniProof-of-concept exploit for CVE-2023-26469 targeting Jorani 1.0.0. Combines path traversal and log injection to achieve remote code execution with an interactive pseudo-terminal.
This is a Proof of Concept (PoC) exploit tool for Jorani 1.0.0, which allows attackers to achieve remote code execution through path traversal and log injection techniques.
⚠️ Warning: This tool is intended for security research and authorized testing only. Unauthorized use of this tool to launch attacks is illegal.
CVE-2023-26469 is a critical security vulnerability in Jorani 1.0.0, combining the following two attack vectors:
Attackers can leverage this vulnerability to execute arbitrary system commands on the target server.
pip install requests pyreadline3
python poc.py <target URL>
python poc.py http://target-server.com
After the script successfully runs, you will enter a pseudo-terminal interface where you can execute system commands:
user@jorani(PSEUDO-TERM)
$ whoami
$ ls -la
$ cat /etc/passwd
Enter exit, quit, or x to exit the program.
language parameter in the login form for path traversal, injecting PHP code into the log fileX-REQUESTED-WITH header to bypass redirect protectionThis tool is intended for security research and educational purposes only. Users must:
The author is not responsible for any misuse or illegal use of this tool.
This project is intended for educational and security research purposes only.