Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-41958-PoC — This is a small proof of concept for CVE-2024-41958 | Kitploit
Tools/GitHubGitHub/orangejuicehu/cve-2024-41958-poc
Authentication & AuthorizationVulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHuborangejuicehu/cve-2024-41958-poc

CVE-2024-41958-PoC

This is a small proof of concept for CVE-2024-41958

View Repository
42 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-41958-PoC

This is a small proof of concept for CVE-2024-41958.

It is possible to bypass the TFA authentication on the admin panel.

Affected versions: < 2024-07

Prerequisites needed for the CVE to function:

  • Password and username for an account without TFA.
  • Password and username for an account which has TFA enabled.
  • Mailcow version below 2024-07.

How to use the poc:

  1. Install the dependency
root@kitploit:~
pip install -r requirements.txt
  1. Fill in the necessary informations in the sript
  • URL
  • Password and username for the user who does not have TFA enabled
  • Password and username for the user who has TFA enabled
  1. Run the script
root@kitploit:~
python poc.py

The output if the script works fine:

root@kitploit:~
PoC works!

PHPSESSID=6cd6779a5e499a0e7708aed3aae9d3a4
  1. Copy the PHPSESSID and set the cookie in your browser

cookie

  1. Refresh the page

  2. You are now logged in as the user with TFA enabled

Author: Patrik Mayor

Download Tool